KR20190009859A - Security inspection respondence system - Google Patents

Abstract

The present invention relates to a security inspection response system comprising a policy generating unit, a scenario storing unit, and a diagnosis performing unit. The policy generating unit connects a security log item DB, a diagnosis index item DB, a schedule DB, and a manager DB, displays an inputting window with which a user can generate a policy scenario for each inspection institution, on a screen in order to generate a policy scenario for each inspection institution depending on information inputted by the user through the inputting window, and sets a diagnosis schedule and a score element and managers of a security log item or a diagnosis index item corresponding to the generated policy scenario. The scenario storing unit stores at least one policy scenario for each inspection institution, which is generated by the policy generating unit, a diagnosis schedule, manager information, and a score element which are set corresponding to the generated policy scenario. The diagnosis performing unit collects a security log for the security log item from each collecting object of a complex security system, calculates an indexed score of each security log item depending on the diagnosis schedule for the security log item corresponding to the collected security log, and evaluates each diagnosis index and each diagnosis index item by using the calculated indexed score of the security log item. The present invention can conveniently and easily correspond to an inspection of a government institution.

Description

{SECURITY INSPECTION RESPONDENCE SYSTEM}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security audit response system, and relates to a security audit response system capable of responding to security audit of different organizations.

Currently, in Korea, personal information protection, such as the collection, use, provision, and destruction of personal information protection law and strengthened measures to strengthen the law, March 30, 2012 is being implemented in earnest. Accordingly, the Personal Information Protection Act extends the personal information protection obligation that has been applied to some organizations such as public institutions, information communication providers, and credit information providers to more than 3.5 million personal information processors, including public institutions, service companies, .

Accordingly, in order to comply with the Personal Information Protection Act, public institutions and companies perform technical measures and administrative measures to protect personal information. In addition, these public organizations and enterprises are self-identifying (diagnosing) the implementation of the obligation to protect personal information and submitting it as data during the audit of government agencies.

However, audits by government agencies on the obligation to protect personal information are conducted for each department, and the diagnostic indicators are not the same for each department. For this reason, it is inconvenient to manage the implementation of information protection in public institutions and companies, and it is also troublesome to write data at every audit. In addition, there is a problem that it takes a lot of time and effort to prepare and check whether the information security is well implemented and evaluated at every audit, and to identify and supplement the parts where the security implementation is not good.

A problem to be solved by the present invention is to provide a system for responding to a security audit, which makes it possible to more easily and quickly respond to audits by government ministries.

Embodiments according to the present invention can be used to accomplish other tasks not specifically mentioned other than the above-described tasks.

In order to solve the above-mentioned problems,

According to one embodiment of the present invention, a security log item corresponding to a government agency audit diagnosis index is set, a diagnosis schedule is set for each security log item, and an evaluation for each security log item and all items is performed according to a diagnosis schedule This is done automatically so that it can be more convenient and easy to respond to audit by government agencies.

FIG. 1 is a diagram showing the relevance of diagnostic indicators according to general government agencies.
2 is a diagram showing a relationship between a diagnostic index item and a security log item according to an embodiment of the present invention.
3 is a diagram illustrating an example of a security log item according to an embodiment of the present invention.
4 is a block diagram of a security audit response system according to an embodiment of the present invention.
5 is a diagram illustrating a configuration of a policy generation unit and a scenario storage unit according to an embodiment of the present invention.
6 is a flowchart illustrating a process of creating a policy scenario in the security audit response system according to the embodiment of the present invention.
7 is a block diagram of a diagnostic execution unit according to an embodiment of the present invention.
8 is an operational flowchart of a diagnostic execution unit according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art to which the present invention pertains. The present invention may be embodied in many different forms and is not limited to the embodiments described herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and the same reference numerals are used for the same or similar components throughout the specification. In the case of publicly known technologies, a detailed description thereof will be omitted.

In this specification, when a part is referred to as " including " an element, it is to be understood that it may include other elements as well, without departing from the other elements unless specifically stated otherwise. Also, the terms " part, " " module, " and the like, which are described in the specification, refer to a unit for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

Hereinafter, a security audit response system according to an embodiment of the present invention will be described with reference to the accompanying drawings.

First, the background of the present invention will be described with reference to FIG. FIG. 1 is a diagram showing the relevance of diagnostic indicators according to general government agencies.

Referring to FIG. 1, a number of government agencies are performing audits (or diagnoses) on whether the personal information protection law or other security-related laws are properly complied with by an institution or an enterprise. For example, in the Ministry of Government Administration and Home Affairs (A), the Korea Information Security Agency (C) has proposed ISMS (Information Security Management System) We are conducting audits to present the guidelines for certification.

For these audits, each institution (A, B, C) has a plurality of diagnostic indicators. According to the "Personal Information Protection Management Level Diagnosis Manual for Public Organizations" in 2014, which is confirmed through a portal site, a plurality of diagnosis indexes are formed, and each diagnosis index is composed of at least one detailed item, that is, a diagnosis index item.

As shown in FIG. 1, each institution has a diagnosis index that is overlapped with each other. For example, the Ministry of Government Administration and Home Affairs (A) and the National Intelligence Service (B) have overlapping diagnostic indicators 1 and 7, and the Ministry of Government Administration and Home Affairs (A) and the Korea Internet Development Agency (C) And the National Intelligence Service (B) and the Korea Internet & Security Agency (C) duplicate the diagnostic indicator 8 and the diagnostic indicator 13. (2) Diagnostic index (4), Diagnostic index (9), and Diagnostic index (12) are duplicated in both the Ministry of Government Administration and Home Affairs (A), National Intelligence Service (B) and Korea Internet &

(A), National Intelligence Service (B), and Korea Internet Development Agency (C) on the basis of one institution or enterprise, for example, the Ministry of Government Administration and Home Affairs (A) (B) on August 10 of the same year, and Korea Internet Promotion Agency (C) on November 10 of the same year. Of course, these dates are intended to illustrate the different audit dates for each institution and are assumed to be assumed.

In addition, different scores and weights are assigned to the same diagnostic indicators for each auditing institution, and the criteria for calculating the scores, that is, the scoring standards, are different. For example, the rating standard in the Ministry of Government Administration and Home Affairs (A) is 100 points if the number of facsimile transmissions is 1 to 100, 50 points if the number of facsimile transmissions is 101 to 1000, If the number is 50, the score is 100. If the score is 51-100, the score is 50.

As the audit schedule of each organization is different and the diagnostic indicators for auditing are different and the scoring criteria are different, the companies or organizations that are audited should prepare the audits of one organization and check the diagnostic indicators again according to the audit schedule of other organizations. There is a lot of waste of time and manpower because there is a need to prepare personnel for the diagnosis index or diagnosis index item, prepare the data, or make a security evaluation.

However, as shown in FIG. 1, the diagnostic indicators in each of the auditors (A, B, and C) are overlapped with each other, and if audits are prepared systematically for each audit institution in the year, Even if the items of the diagnostic indicators or the diagnostic indicators are slightly changed, it becomes easy to prepare the audits.

The present invention grasps duplicate diagnostic indicators and non-redundant diagnostic indices according to each of these auditing organizations, thereby enabling to centrally manage diagnostic indices that are not duplicated among the diagnostic indices of the next auditing entity, and furthermore, To make it easier to respond to audits for each audit organization in the year concerned.

2 is a diagram showing a relationship between a diagnostic index item and a security log item according to an embodiment of the present invention. Referring to FIG. 2, in general, a complex security system (or an integrated security system) 10 introduces various security solutions to prevent internal information leakage and external intrusion in a company, It is a system of a security system composed of a combination of solutions. The composite security system 10 includes ESM (Enterprise Security Management) and SIEM (Security information and event management).

The complex security system 10 includes various security solutions. For example, as a security solution, a DDoS (Distributed Denial of Service Attack), APT (Advanced Persistent Threats, Intelligent Sustainment Threats) There is a web firewall on the web server side, DB security, access control and account management on the DB (database) server side, and a spam blocking solution on the mail server side. In addition, there are vaccines, PC vulnerabilities, prevention of information leakage (including document leakage prevention), and document security solutions on the PC and file server side.

The security log is collected through each security solution of the composite security system 10, and a plurality of security log entries 20 are grasped by using the collected security log. The plurality of security log items 20 thus identified corresponds to one of the diagnostic index items for the diagnostic indicators of the respective auditing organizations (A, B, and C). That is, one diagnostic index item is identified as at least one security log item.

Here, the security log is various data related to the security log item (refer to FIG. 3), for example, not only the log information generated in the security device or the security solution, but also security data according to the user action related to the security log item.

An example of a security log entry is shown in FIG. 3 is a diagram illustrating an example of a security log item according to an embodiment of the present invention. Referring to FIG. 3, the security log item is divided into first information related to internal information leakage security and second information related to external intrusion security, and the second information is again classified into information related to security log indexing related to PC vulnerability, It is classified as information related to related security log indexing.

The first information may include, for example, a PC non-encrypted resident number storage, a PC encrypted resident number storage, a PC non-encrypted personal information storage, a USB non-encrypted personal information storage, a USB encrypted personal information storage, Outsourcing, and over-viewing of system personal information.

The information related to PC vulnerability related security log exposition information includes Windows automatic logon, PC logon password stability, screen saver setting, (user) shared folder setting, (all) shared folder use, There are various types of security log indexing information such as user access control, IE, ID / PW autocomplete setting, and unused (3 months) ActiveX program. Malicious code related infection log files, And the number of phishing mail infections.

4 is a block diagram of a security audit response system according to an embodiment of the present invention. 4, the security audit response system 100 according to the embodiment of the present invention includes a user input unit 110, a policy generation unit 120, a security log item DB 131, a diagnostic indicator item DB 132, A schedule DB 133, a representative DB 134, a scenario storage unit 140, and a diagnosis execution unit 150, and may further include a sanction unit 160 as the case may be.

The user input unit 110 is operated by a user to input a command or information desired by the user, and outputs a command or information inputted by the user as an electrical signal.

The policy creating unit 120 displays an input window on the screen allowing the user to create a policy scenario for each audit institution so that the user can input or select information desired by the user through the user input unit 110. [ The information displayed in the various input windows provided to the user is based on the information stored in the security log entry DB 131, the diagnostic index entry DB 132, the schedule DB 133, and the contact person DB 134.

Here, the policy scenario means that the security log item corresponding to the diagnostic index item of the diagnostic index for each audit institution is matched and the information (or data) about the matched security log item is collected according to the set schedule. At this time, the policy scenario is set up with a person who manages the information (or data) to be collected, and the person in charge may be one or more persons depending on the characteristics of the diagnosis index item or the security log item.

The security log entry DB 131 stores information and identification information on all security log entries shown in FIG. Information about all the security log items stored in the security log entry DB 131 is information input by the user, and the information stored in the security log entry DB 131 is modified by adding, deleting, or changing the information.

The diagnostic index item DB 132 stores all types of diagnostic indicators and diagnostic index items required by each auditing institution. In the case of storing the previous audit information of each audit institution, the diagnostic index item DB 132 stores all kinds of diagnostic indicators and diagnostic index items required by the respective audit institutes. And each diagnostic indicator is matched with identification information of at least one associated auditing entity. This matching relationship is as shown in Figs. 1 and 2. Fig. All diagnostic indices stored in the diagnostic index item DB 132 and information on the diagnostic index items and the matching relationship are entered or set by the user and added, deleted, or changed by the user.

On the other hand, in the diagnostic index item DB 132, only the information on the diagnostic index, the identification information, the information on the diagnostic index item, and the identification information are stored, and based on the information on the security log item in the security log item DB 131 1 and FIG. 2, and the diagnostic index and the matching relationship with each auditing institution.

The schedule DB 133 stores schedule information for each security log item. The schedule DB 133 is a database that is created by manual operation of a specific person such as a check log of security log items (such as a markup or proof sheet) or a security activity check of an individual or an organization, , And in this case, the schedule information for the corresponding security item is also stored. The schedule information for each security log item is divided into collection schedule information for collecting the security log and diagnostic schedule information for evaluating the diagnosis index. Ideally, all security logs should be collected on a daily basis, so that collection schedule information does not have to be set separately. However, the diagnostic schedule information depends on the type of the diagnostic index item. This is because the diagnostic indicator item may be an evaluation of security information that is identified on a daily basis or an evaluation of security information that is collected by period.

 For example, the diagnostic schedule information is classified into daily, weekly, monthly, or two-month depending on the type of the security log item. The schedule information corresponding to the security item is set based on the audit date of the relevant audit (audit date). For example, a week before the audit, a month ago.

The person in charge DB 134 stores the information of each party of each security log item. There can be one person in charge per log item, and it can be two or more, and one log person can take charge of plural log items.

The scenario storage unit 140 stores at least one audit agent-specific policy scenario generated by the policy generation unit, a schedule set in correspondence with the generated policy scenario, a person in charge, and a score element. Of course, the policy scenario stored in the scenario storage unit 140 is a policy scenario corresponding to the audit of the earliest audit institution from the present day if the audit days of the respective audit organizations have sufficient time.

The diagnosis execution unit 150 performs security according to the policy scenario stored in the scenario storage unit 140. [ That is, the diagnosis execution unit 150 collects data (i.e., a security log) about the security log items in synchronization with the collection schedule information from the composite security system 10 in accordance with the policy scenario, Evaluate (diagnose) indicators and diagnostic indicators.

The sanction unit 160 receives the exponentation score of each security log item calculated by the diagnosis execution unit 150 and uses the exponentation score of each security log item to generate a diagnosis result report for the diagnosis index and the diagnosis index item And identify security log entries whose exponentiation score is lower than the set score, and sanction the person in charge of the corresponding security log item. The sanctions include notifying the security officer of the security risk of the security log item in charge, instructing the person in charge to resolve the security risk, or providing information on the disadvantage to the person in charge.

Hereinafter, the policy generating unit 120 according to the embodiment of the present invention will be described in more detail with reference to FIG. 5 is a diagram illustrating a configuration of a policy generation unit and a scenario storage unit according to an embodiment of the present invention.

5, the policy generation unit 120 includes a matching unit 121, a person setting unit 122, a schedule setting unit 123, and a score factor setting unit 124. [

The matching unit 121 allows the user to match the security log item corresponding to the diagnostic indicator of the specific auditing institution through the input window by using the diagnostic index item DB 131 and the security log item DB 132. [

Basically, if the data used at the time of previous audit for the auditor inputted by the user is stored in the diagnostic index item DB 131, the matching unit 121 receives an audit for the relevant monitoring institution from the diagnostic index item DB 131 Information (diagnosis index, diagnostic index item, security log item matched to the diagnostic index item, and the like) and displays it through the input window in response to the user request.

For example, when the user inputs an auditing organization to the administrative orgent department A, the matching unit 121 compares the diagnostic indicator, the diagnostic indicator item, and the diagnostic indicator item corresponding to the administrative autonomic unit A previously stored in the diagnostic indicator item DB 131 Is displayed on the input window. As another example, the input window shows a list of diagnostic indicators stored in association with the administrative unit A. When the user selects one of the diagnostic indicator lists, a diagnostic indicator item list of the diagnostic indicators is displayed. In the diagnostic indicator item list When the user selects one, at least one security log entry matched to the diagnostic metric item selected by the user is displayed.

In this way, the user can confirm the security log items matched with the diagnostic indicators of the auditing institution, the diagnostic indicators corresponding to the diagnostic indicators, and the diagnostic indicators stored in the input window, and the diagnostic indicators, diagnostic indicators If there is a diagnosis index or diagnosis index item added or changed or deleted or added in the last year of comparison, the comparison is made to the diagnostic index or diagnosis index item added or deleted or added through the input window. At this time, editing can be performed by inputting a new diagnostic indicator or by finding and setting a security log item to be matched with a new diagnostic indicator item in which a new diagnostic indicator item is registered and registered, or by deleting and deleting diagnostic indicators and diagnostic indicator items Deletes security log entries that have been matched with the indicator item, changes the contents of the diagnostic indicator or diagnostic indicator item, and changes the matching security log item accordingly.

On the other hand, if the previously received audit information such as the previous year or the previous year for the auditing institution is not stored in the diagnostic index item DB 131, A diagnostic index and a diagnostic index item are entered and a security log item corresponding to the diagnostic indicator item input through the input window is set to match one or more of the security log item list stored in the security log item DB 101. [

When the matching unit 121 completes the matching of the security log item corresponding to the diagnostic index to the relevant auditing institution by the user, the matching unit 121 matches each diagnostic index corresponding to the identification information of the auditing institution, Matches the security log items corresponding to each diagnosis index item, and stores the matched information as the " diagnosis policy " in the diagnosis policy storage unit 141. [

When the security log entry is matched and registered in correspondence with the diagnostic indicator item of the monitoring organization by the matching unit 121, the agent setting unit 122 grasps the person in charge of the registered security log item from the person in charge DB 134, And sets it as the person in charge of the security log item corresponding to the auditing institution and stores it in the person in charge storage unit 142. [ Of course, the contact person setting unit 122 may change, delete, or add the contact person information stored in the contact person storage unit 142 through the matching unit 121 in the previously stored contact person information if the contact person information of the security log item corresponding to the pre- Only the security log entries can be edited. The contact person setting unit 122 notifies the security log item or data (proof, data, and the like) that the person in charge is in charge of by the person in charge of the contact with the schedule setting unit 123, Provide information about check dates for security log entries.

When the matching unit 121 matches the security log entries corresponding to the diagnosis index items of the monitoring organization and registers them, the schedule setting unit 123 grasps the diagnostic schedules for the registered security log items from the schedule DB 133 As the diagnostic schedule of the security log item corresponding to the diagnostic indicator item of the relevant auditing institution, and stores it in the schedule storage unit 143. [ Of course, if there is the schedule information for the diagnosis of the security log item corresponding to the audit institution previously stored in the schedule storage unit 143, the schedule setting unit 123 may change, delete, and add the previously stored schedule information through the matching unit 121 You can only edit the schedule for security log entries.

The score factor setting unit 124 can set a rating criterion, a score, a weight, and a policy score for each diagnostic indicator item for each diagnostic indicator of the relevant monitoring organization through an input window. And is stored in the score element storage unit 144 by matching with the matched diagnosis index and the diagnosis index item. If the point element storage unit 144 has previously stored information for the auditing institution, the score element setting unit 124 sets the score element only for the diagnostic index or diagnostic index item to be changed, deleted, or added through the matching unit 121 You can edit the element.

Next, the scenario storage unit 140 includes a diagnosis policy storage unit 141, a contact person storage unit 142, a schedule storage unit 143, and a score element storage unit 144. The information stored in each of the storage units 141 to 144 of the scenario storage unit 140 is stored at least until the audit date of the relevant audit organization and is deleted after the audit date. The information stored in the diagnostic policy storage unit 141 is transferred to and stored in the diagnostic index item DB 131. The information stored in the contact person storage unit 142 is transferred to and stored in the contact person DB 134. In the schedule storage unit 143, Is stored in the schedule DB 133, and information stored in the score element storage unit 144 is transferred to the diagnostic index item DB 131 and stored.

Hereinafter, a process of generating a policy scenario in the security audit response system according to an embodiment of the present invention will be described with reference to FIG. FIG. 6 is a flowchart illustrating a process of creating a policy scenario in the security audit response system according to the embodiment of the present invention, when the audit information of the relevant audit institution is not stored in the scenario storage unit 140.

Referring to FIG. 6, when a user requests to create a policy scenario through the user input unit 110, the matching unit 121 of the policy generating unit 120 displays an input window on the screen (S601). The user inputs or selects an audit institution of the policy scenario to be created through the input window (S602).

The user requests a diagnostic indicator stored in the diagnostic indicator item 131 to match the diagnostic indicator and the diagnostic indicator item performed by the relevant auditing institution with the corresponding auditing entity through the input window, The list of indicators is displayed on the screen. If the user selects or inputs one diagnostic index (S603), the policy creating unit 120 registers the diagnostic index and lists the diagnostic index items stored in the diagnostic index item DB 131 And displays it on the screen.

When the user selects at least one of the diagnostic index item list displayed or the user directly inputs the diagnostic index item, the policy creating unit 120 matches the selected or input diagnostic index item with the corresponding item of the diagnostic index (S604) .

The policy creating unit 120 displays a list of security log items stored in the security log entry DB 132 as a list in order to match the security log entries corresponding to the diagnostic index items selected or input by the user, The user selects at least one security log item corresponding to the diagnosis index item in the security log entry list (S6605).

Then, the policy creating unit 120 matches at least one security log item selected by the user with the corresponding diagnostic index item (S6607). If one of the diagnostic index items matches at least one security log item, the policy creating unit 120 sets a contact person for the corresponding security log item in correspondence with the corresponding diagnostic indicator item (S608) (S6609). The user schedules and registers scoring and policy scores for the diagnostic index and diagnostic index items (S610).

On the other hand, if the matching with the security log item for all the diagnostic index items corresponding to one diagnostic indicator is not completed (S611), the processes of S604 to S610 are repeated. If the matching with the security log item for all the diagnostic indicators is not completed (S6612), the next diagnostic indicator is selected or inputted by the user, and steps S604 to S611 are repeated.

In another embodiment, the scenario storage unit 140 may store audit information of the corresponding auditing entity. In this case, when the user inputs or selects the relevant auditing institution, the policy generating unit 120 grasps the previous audit information of the relevant auditing institution and collects the diagnosis index, the diagnosis index item and the diagnosis index item, the score, the policy score, and the weight And the user is able to grasp the diagnostic indicators, diagnosis index items, rating points, policy scores, and weights of the current auditing institution so that the user can modify and register only information different from the previous audit. This process will be easily understood by a person skilled in the art through the above-mentioned embodiments, and a detailed description will be omitted.

7 is a block diagram of a diagnostic execution unit according to an embodiment of the present invention. 7, the diagnostic execution unit 150 according to the embodiment of the present invention includes a meta information generation unit 151, a collection logic generation unit 152, a log collection unit 153, an interface unit 154, And a parsing unit 155 and an exponentizing unit 156.

The meta information generation unit 151 generates meta information about each collection target of the compound security system 10 as a target device. To this end, the meta information generation unit 151 provides a log format for the corresponding collection object when the user requests meta information setting for one of the plurality of collection targets, When an attribute value is input in each attribute value display field of the log format, meta information is generated by the input attribute value.

The collected objects include security equipment such as various security equipment, firewall, web firewall, TMS (Threat Management), ESM, and security solutions such as DDoS, APT, access control, spam mail, server vulnerability, vaccine and PC vulnerability.

The log format is basic information that allows the log collection unit 153 to access a collection target and collect security logs such as log information and security data that are required. . The attribute values included in the log format include a first attribute value for the kind and specification of the collection object, a second attribute value for accessing the collection object, and a second attribute value for specifying information (or data) to be collected from the collection object 3 attribute value.

For example, when the information to be collected is " document encryption information ", each attribute value included in the log format is as follows.

Target equipment: DLP (Data Leakage Prevention) or DB (DataBase)

Equipment IP (Internet Protocol): 10.0.0.1

DB type (type): ORACLE

Connection ID (identification): user

Password: 1234567

Collected items (information to collect): log number, media control code, employee number, process name, file name, file size, executable file, execution date, IP address, MAC address, regular expression pattern, keyword, etc.

Key field: Regular expression pattern

Key field separator: Category "," Numeric value ":"

In the respective attribute values, the first attribute value corresponds to the target equipment and DB type, the second attribute value corresponds to the equipment IP, the connection ID, and the password, and the third attribute value corresponds to the remaining attribute values.

The target device means equipment or solution for collecting security information (hereinafter referred to as "security log"), and DLP is displayed as "DLP" or "DB" since it is a solution installed in the database server. The key field is a data field area containing security information to be extracted, and a key field separator designates an identifier (i.e., a separator) for identifying security information (security data) to be extracted from the data recorded in the key field . According to the attribute value, the category data is divided and indicated by a separator of ", ", and the numerical value is displayed separately by a separator ": ".

As another example, when collecting a security log from a firewall, it can have the following attribute values.

Target Equipment: Firewall

Transmission method: SYSLOG

Device version: 1.1.1

Equipment IP: 10.0.0.1

Username: user

Password: 1234

Collection Items (Information to Collect): Log number, Soruce IP, Destination IP, Source Port, Destination Port, InBound Traffic, Outbound Traffic, Packet Size, Attack Type, Action

Field separator: category "=", numeric value ","

Key field: Attack Type field

The transmission method in the attribute value may be expressed as FTP, UDP, SYSLOG, SNMP, or the like in case of other security equipment or solution.

The meta information generation unit 120 generates meta information using the attribute value input by the user, and provides the meta information to the collection logic generation unit 130.

The collection logic generation unit 152 obtains a target security log by automatically accessing the corresponding collection object by using the attribute values obtained by grasping each attribute value from the meta information received from the meta information generation unit 151, That is, a collection logic program is generated. The collection logic generation unit 152 provides the collected collection logic program to the log collection unit 153. [

The log collection unit 153 executes the collection logic program for the corresponding collection object received from the collection logic generation unit 152 according to the schedule storage unit 143 included in the scenario storage unit 140, Collects each target security log from the collection target. On the other hand, when the security log to be collected is a SYSLOG, it is received in real time from the corresponding device, so that no separate schedule information is required.

The interface unit 154 has a communication interface such as TCP, UDP, SYSLOG, FTP, OCI, ODBC, and SNMP. The log collection unit 153 collects, To connect to and communicate with the object to be collected. The interface unit 154 accesses the agent and collects the security log from the agent when the collection target is a server such as a DB server, a web server, or a mail server. Here, the agent is a device for collecting the security log from each server.

An example of the type of security log collected by the log collecting unit 153, that is, a security log item, is shown in FIG.

The analyzing and parsing unit 155 receives the security log from the log collecting unit 153 and analyzes the type of the received security log, that is, the security log item, and parses and analyzes the obtained security log item according to the data type and the security risk type . Here, the security log collected from the log collecting unit 153 is the information designated as the " key field " in the meta information, and the log number, the media control code, the employee number, the process name, , File size, executable file, execution date, IP address, MAC address, regular expression pattern, and keyword. The information designated as the collection item is not limited to the above description, and can be arbitrarily changed by the manufacturer. When the received security log is " SYSLOG ", it includes date information, ID information, source information, destination information, and packet information.

The data types are classified into count type, date type, and OX type. The count type is data that can count user actions, and the date type is data that can detect whether the user's behavior is against security based on the date. OX can determine whether or not the user's action has performed a security action .

For example, the counted data is data that allows the user to know how many personal information files that the user has unencrypted in the PC, how many pieces of personal information have been downloaded, and how many documents are printed by the multifunction peripheral . The date data is data that allows the user to determine whether the user has not been vaccinating for several days (or within a few days), or for a few days of office security patch checks. And, the OX type data is data that enables to know whether or not the screen saver setting check is performed, the Windows automatic log-on check is performed, and the like.

In the above, the type of security risk corresponds to "middle class" in FIG. 3, and information leakage, vulnerability, and malicious code infection exist.

The analysis and parsing unit 155 analyzes the SYSLOG security log to identify the data type and the type of security risk, and obtains the date information, the ID information, the source information Information, destination information, packet information, and the like, parses the extracted information, and stores the parsed information in a storage unit (not shown).

For each security log item stored and parsed by the analyzing and parsing unit 155, the exponentiation unit 156 calculates a weight for each diagnostic item stored in the score storage unit 144 and a policy The score and rating criteria are used to index each security log entry matched with the diagnostic indicator item.

The exponentiation unit 156 grasps the user through the user identification information (IP, MAC address, employee number, etc.) included in the security log, grasps the occurrence date of the security log, The fact data corresponding to the log entry is grasped from the security log and a result value corresponding to the data type is calculated. For example, the result value corresponds to the count value (the number of cases or the number of times) in the case of the counter type, corresponds to "yes" or "no" in the case of the OX type, ).

The exponentiation unit 156 calculates a result value for each security log item, and uses the resultant value, the score criterion, the weight score, and the policy score for each security log item stored in the scenario storage unit 140, The score is calculated. For example, if the weight of the diagnostic index item matched with the security log item "Keep the PC unencrypted resident registration number" is "50", the score is 100 when the score criterion and policy score is "0" If the result of the security log entry, that is, the number of retained resident numbers is 90, the exponentiation unit 156 determines that the policy score of the corresponding security log item is 70 points, and accordingly, (50 * 70) / 100 = 35 points by substituting the weighted score * policy score) / 100, which is an exponential score calculation formula.

The exponentiation score calculation is performed for all the security log items, and the exponentifier 156 provides exposition scores of all the security log items to the sanction unit 160.

Hereinafter, the operation of the diagnostic execution unit according to the embodiment of the present invention will be described with reference to FIG. 8 is an operational flowchart of a diagnostic execution unit according to an embodiment of the present invention.

Referring to FIG. 8, when a user requests meta information setting for one of the collection targets (i.e., security equipment and solutions) of the complex security system through the user input unit 110, the meta information generation unit 120 Log format input screen is provided. Then, the user selects one collection target through which to input the log format through the log format input screen, and inputs an attribute value into each attribute value display field of the log format for the selected collection target.

The meta information generation unit 120 stores (sets) an attribute value of the log format input by the user (S801), and generates meta information about the object to be collected with each attribute value of the log format (S802). The user inputs attribute values of the log format for all security devices and security solutions and generates corresponding meta information through the steps S801 and S802 before collecting the security log from the complex security system.

The meta information generation unit 151 provides the generated meta information to the collection logic generation unit 130 when the meta information for one collection target is generated and the collection logic generation unit 152 generates the meta information for each attribute And acquires a target security log by automatically accessing the corresponding collection object using the acquired attribute values, and provides the collected collection logic program to the log collection unit 153 (S803 ).

The log collecting unit 153 sets the received collecting logic program corresponding to the corresponding collecting object, and sets the collecting logic program corresponding to all the collecting objects by the setting operation (S804).

The log collection unit 153 executes each collection logic program according to the first schedule information for each security log item stored in the schedule storage unit 143 and accesses each collection object through the interface unit 154, (S805).

Each security log collected by the log collecting unit 153 is provided to the analyzing and parsing unit 155. The analyzing and parsing unit 160 analyzes the received security log to identify the security log item, And parses them according to types and security risk types (S806).

The exponentiation unit 156 obtains the fact data from the data parsed by the analysis and parsing unit 155 (S807), and calculates and stores the resultant value using the fact data (S808).

The security log exponent 156 obtains a policy score corresponding to each of the result values of each security log item (S809), and calculates an index score using the score of the policy and the weight score corresponding to the security log item (S810) .

In the above, steps S809 to S810 are performed according to the second schedule for each security log item.

While the present invention has been particularly shown and described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It belongs to the scope.

100: Security audit response system 110: User input
120: Policy generation unit 131: Security log entry DB
132: diagnosis index item DB 133: schedule DB
134: Person in charge DB
140: scenario storage unit 150: diagnosis execution unit
160: sanction unit 121: matching unit
122: Person in charge setting unit 123: Schedule setting unit
124: score element setting section

Claims (5)

A security log entry DB storing information and identification information of all security log entries,
Diagnostic index items DB, which stores all types of diagnostic indicators and diagnostic index items required by each audit organization,
A schedule DB that stores diagnostic schedule information for diagnosing a diagnosis index item for each security log item,
The DB of the person who stores the information of the individual by each security log item or the diagnosis index item,
An input window for allowing the user to create a policy scenario for each audit institution in association with the security log entry DB, the diagnostic index entry DB, the schedule DB, and the agent DB, A policy generating unit for generating a policy scenario for each audit institution in accordance with the information, setting a person in charge of the security log item or the diagnostic indicator item and the diagnostic schedule and score elements corresponding to the generated policy scenario,
A scenario storage unit for storing at least one policy-specific audit scenario generated by the policy generation unit, a diagnostic schedule set in correspondence with the generated policy scenario, personnel information and score elements, and
Collecting a security log for a security log item from each collection target of the multiple security system, calculating an exponential score of each security log item according to the diagnostic schedule for a security log item corresponding to the collected security log, A diagnostic execution unit for evaluating each diagnostic index and the diagnostic index item using the exponential score of the log item
The security audit response system. The method of claim 1,
Generates a diagnosis result report for the diagnosis index and the diagnosis index item by using the exponential score of each security log item calculated by the diagnosis execution unit, identifies the security log item whose exponential score is lower than the set score, A security audit response system further including a sanctioning section for sanctioning the person in charge of the item. 3. The method according to claim 1 or 2,
Wherein the policy generation unit includes:
A matching unit for matching and registering a security log item corresponding to each diagnostic indicator item of a specific audit institution according to an instruction by the user using the diagnostic indicator item DB and the security log item DB,
When the security log entry is registered in correspondence with the diagnosis index item of the monitoring organization by the matching unit, the contact person is identified from the contact person DB for the registered security log item, and the security log item corresponding to the security log item And stores it in the scenario storage unit,
A schedule setting unit for, when the security log entry is matched with the diagnostic indicator item of the monitoring organization by the matching unit, registering the diagnostic schedule for the registered security log item and storing the diagnosed schedule in the scenario storage unit, And
When the security log entry is registered in a matching manner with the diagnostic indicator item of the monitoring organization by the matching unit, the rating standard, the score, and the weight of the diagnostic indicator item corresponding to the registered security log item are matched according to the user's instruction A security audit response system including a score factor setting unit to be registered. 3. The method according to claim 1 or 2,
Wherein the diagnosis execution unit comprises:
A meta information generation unit for generating meta information about a collection object as an attribute value of a log format for each collection target of the composite security system input by the user,
A collection logic generating unit for acquiring a plurality of attribute values from the meta information and generating a collection logic program capable of acquiring a target security log from a collection target using the acquired attribute values,
A log collector for collecting a security log from each collection object using a collection logic program for each collection object,
An analysis and parsing unit for grasping security log items for the security log collected by the log collecting unit and parsing the security log data for each data type and security risk type,
For each security log item parsed and stored by the analyzing and parsing unit, for each security log item matched with the corresponding diagnostic indicator item, using the weight of the diagnostic indicator item corresponding to the corresponding security log item, the policy score, And an indexing unit for calculating an exponentiation score. 5. The method of claim 4,
The log collecting unit collects the security log from each collection target by executing the collecting logic program for each collection object every day,
Wherein the exponentiation unit operates according to the diagnostic schedule set corresponding to each security log item to calculate an exponentiation score for the corresponding security log item.

Images