KR20200054495A - Method for security operation service and apparatus therefor - Google Patents

Abstract

Provided is a security control service system, which comprises: a terminal generating a security event by attempting or accessing an information system; a management terminal; and a security control service device detecting a security event for real-time monitoring and security risks for each node of an information system of a public institution in accordance with the access attempt or access of the terminal, analyzing security events related to the security risks detected as a result of the real-time monitoring, separating the security risk event from the analyzed security events, determining the security risk level of the separated security risk event, blocking the security risk for the security event determined as a security risk factor based on a predefined threshold value, reporting to the management terminal, and updating the security data.

Description

METHOD FOR SECURITY OPERATION SERVICE AND APPARATUS THEREFOR

The present invention relates to a security control service, and more particularly, to a system for monitoring real-time information of a security threat element of the information system, a security control service method for intrusion detection and intrusion prevention of the security threat element, and an apparatus therefor It is about.

Technology is advancing and many social infrastructure systems are digitizing accordingly. Technological advances in these digital systems provide convenience, while concerns about security threats from viruses or hacking are increasing.

In particular, hacking that sneaks through a communication network such as the Internet and disturbs or paralyzes information systems is becoming increasingly intelligent and advanced.

In relation to this, the information systems of local governments and public institutions are relatively vulnerable to such hacking and fail to respond quickly compared to general enterprises, and suffer much damage.

Hacking damage to the information system of local governments or public organizations can be more problematic because it can be varied and vast due to public interest or information related to it.

Therefore, there is an urgent need to prepare a security system for information systems of local governments and public organizations.

One object of the present invention is to provide a security control service method for real-time information monitoring of security threat elements for an information system of a local government or public institution, intrusion detection and intrusion prevention of the security threat elements.

Another object of the present invention is to provide an apparatus or system for providing the security control service method.

The technical problems to be achieved in the present invention are not limited to the above technical problems, and other technical problems not mentioned will be clearly understood by a person having ordinary knowledge in the technical field to which the present invention belongs from the following description.

The security control service method according to an embodiment of the present invention for solving the above-described problems, detects real-time monitoring of each node of a public institution's information system and security events related to security risks according to the access attempt or access of the terminal. To do; Analyzing security events related to security risks detected as a result of the real-time monitoring; Separating a security risk event from the analyzed security events, determining a security risk level of the separated security risk event, and blocking a security risk for a security event determined as a security risk factor based on a predefined threshold; And reporting the results to the management terminal, and updating the security data; characterized in that it comprises a.

According to an embodiment of the present invention, the security risk blocking step is characterized in that it further comprises the step of transmitting an indication request for a security event determined to be a security risk factor to the management terminal.

According to an embodiment of the present invention, when the security risk level of the separated security risk event is less than a predefined threshold, it is characterized in that additional security events of the security risk event are collected for a predefined time.

According to an embodiment of the present invention, the security risk level is judged by comparing with the threshold based on the additional security event of the collected security risk event, but if the security risk level as a result of the judgment continues to be below the threshold value It is characterized by releasing the security risk event attribute of the corresponding security risk event.

According to an embodiment of the present invention, further comprising the step of storing a black list for the security event; the security event included in the black list is automatically separated and managed as a security risk event, and the black list The corresponding security risk event is characterized by performing security risk blocking by strictly applying a threshold for determining the security risk level, or performing security risk blocking with priority without performing a security risk level.

Security control service system according to an embodiment of the present invention, the terminal attempts to access or access the information system to generate a security event; Management terminal; And detecting security events related to real-time monitoring and security risks for each node of the public institution's information system according to the access attempt or access of the terminal, and analyzing security events related to the security risks detected as a result of the real-time monitoring. Separating the security risk event from the analyzed security events, determining the security risk level of the separated security risk event, blocking the security risk for the security event determined as a security risk factor based on a predefined threshold, and as a result It characterized in that it comprises a; security control service device for reporting to the management terminal, and updating the security data.

According to an embodiment of the present invention, the security control service device is characterized in that it transmits an instruction request for a security event determined as a security risk factor to the management terminal and performs a security control service according to the returned instruction. .

According to an embodiment of the present invention, when the security risk level of the separated security risk event is less than a predefined threshold, the security control service device collects additional security events of the security risk event for a predefined time. It is characterized by.

According to an embodiment of the present invention, the security control service device judges a security risk level by comparing with the threshold based on the additional security event of the collected corresponding security risk event, wherein the security risk level is the result of the judgment If it continues to be below the threshold, the security risk event attribute of the security risk event is released.

According to an embodiment of the present invention, the security control service device stores a black list of security events, automatically separates and manages security events included in the black list as security risk events, and the black list The security risk event corresponding to is characterized by performing security risk blocking by strictly applying a threshold for determining the security risk level, or performing security risk blocking with priority without performing a security risk level.

According to the present invention as described above, the effects described below can be obtained. However, the effect obtainable through the present invention is not limited thereto.

First, according to the present invention, there is an effect capable of providing a security control service method for real-time information monitoring of security threat elements for an information system of a local government or a public institution, intrusion detection and intrusion prevention of the security threat elements.

Second, according to the present invention, there is an effect that can provide an apparatus or system for providing the security control service method.

1 is a schematic diagram of a real-time security monitoring and security control system according to an embodiment of the present invention.
2 is a diagram showing components of a monitoring / security control service server stage according to an embodiment of the present invention.
3 is a configuration diagram of a video system of a security control system according to an embodiment of the present invention.
4 is a flowchart illustrating a security control method according to an embodiment of the present invention.
5 is a view for explaining the configuration of the security control device according to an embodiment of the present invention.
6 is a view showing an actual implementation of the security control comprehensive situation room according to an embodiment of the present invention.
7 is a view showing an actual implementation of the personal terminal according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. DETAILED DESCRIPTION The following detailed description, together with the accompanying drawings, is intended to describe exemplary embodiments of the present invention, and is not intended to represent the only embodiments in which the present invention may be practiced.

Only the present embodiments are provided to make the publication of the present invention complete, and to fully disclose the scope of the invention to those skilled in the art to which the invention pertains, and the present invention will be defined by the scope of the claims. That's it.

In some cases, in order to avoid obscuring the concept of the present invention, well-known structures and devices may be omitted, or block diagrams centered on the core functions of each structure and device may be illustrated. In addition, the same components throughout the specification will be described using the same reference numerals.

Throughout the specification, when a part "comprising or including" a certain component, this means that other components may be further included instead of excluding other components, unless otherwise specified. do.

In addition, the term “?” Described in the specification means a unit that processes at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software. Furthermore, "a (an or an)", "one (one)", and similar terms in the context of describing the present invention, unless otherwise indicated or clearly contradicted by the context, both singular and plural. It can be used in a sense that includes.

In addition, specific terms used in the embodiments of the present invention are provided to help understanding of the present invention, and unless otherwise defined, all terms used herein, including technical or scientific terms, are used in the present invention. It has the same meaning as commonly understood by a person skilled in the art to which they belong. The use of these specific terms may be changed in other forms without departing from the technical spirit of the present invention.

In this specification, the security threat element real-time information monitoring for the information system of the government, local government, or public institution (hereinafter referred to as 'public institution') according to the present invention, the security control method for intrusion detection and intrusion prevention of the security threat element And devices and systems therefor.

Meanwhile, the present invention can detect a security event in a bottom up manner and provide a security control service based on the detected result. According to this bottom-up security control service, it is possible to immediately respond to the occurrence of security events for each node or link unit constituting the information system of a public institution, not an attack on the main server of the security control service, You can respond more effectively to security risks, thus minimizing the damage caused by security risks.

1 is a schematic diagram of a real-time security monitoring and security control system 100 according to an embodiment of the present invention.

Referring to FIG. 1, the real-time security monitoring and security control system 100 is composed of at least one terminal 110 and a monitoring / security control service server end.

The terminal 110 refers to a device that attempts or connects to a public institution information system. Here, the terminal 110 may mean not only a device that accesses the public institution information system from outside, but also a device that uses the information system through an internal intranet or the like.

According to the embodiment, to the terminal 110, a terminal device, a terminal (Terminal), MS (Mobile Station), MSS (Mobile Subscriber Station), SS (Subscriber Station), AMS (Advanced Mobile Station), WT (Wireless terminal) ), At least one of a Machine-Type Communication (MTC) device, a Machine-to-Machine (M2M) device, and a Device-to-Device (D2D) device. As a specific example, the terminal 110 may be a mobile phone, a smart phone, a tablet PC, a personal PC, a laptop, and the like.

In addition, the above-mentioned terminal is only an example, and the terminal in the present invention should be interpreted as a concept including all devices that are currently developed and commercialized or are capable of transmitting data or signals to be developed in the future in addition to the above-described examples. .

The monitoring / security control service server unit comprises a security risk detection module 120, a security risk analysis module 130, a security risk blocking module 140, a monitoring system 150, and a security support module 160. do.

However, the present invention is not limited to this, and if necessary, modules may be added, or at least two or more of the above-described modules may be implemented as one module, or some modules may be omitted.

In the above, the security risk detection module 120 detects and collects various types of security events for public institution information systems based on firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS).

Here, the security event may refer to only events related to security risks from various access and access attempt events according to the access of the terminal 110. Meanwhile, the event related to the security risk may be determined based on data provided or updated by a service provider providing a security system.

In addition, the security risk detection module 120 detects security risk factors that may be a real threat to or threat of a public institution information system, that is, damage to the public institution information system from the detected and collected security events. After classifying it, it is transferred to the security risk analysis module 130.

The security risk detection module 220 detects the action of the terminal 110 such as access, login, request, and result reception of the terminal 110 accessing the public institution information system and determines whether it is a security risk. Therefore, the result data is transmitted to the security risk analysis module 130.

The security risk analysis module 130 supports a real-time monitoring system 160 and analyzes various security events collected through the security risk detection module 120.

The security risk analysis module 130 determines the security risk level of the corresponding security event based on the analysis result of various security events, and generates security risk data according to the determined security risk level to generate security risk It can report to the blocking module 140 and the real-time monitoring system 150.

The security risk blocking module 140 blocks the security risk based on the result data of the security risk analysis module 130. To this end, the security risk blocking module 140 may be operated under the control of the monitoring system 150.

The security risk blocking module 140 includes a number of firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), vulnerability analysis systems, anti-virus systems, server security systems, virtual private networks (VPN), etc. It may be an integrated security management service system (ESM) that brings together a security solution.

The monitoring system 150 determines whether to continuously monitor the security event according to the determined security risk level and security risk.

The determination of whether to continuously monitor, for example, the security risk and the security risk level is below a predefined threshold, so rather than performing security risk blocking or security control, monitoring is continuously performed for a predetermined time to collect additional security events. This is to judge whether there is a security risk and whether to judge or monitor the security risk level.

Here, if the security risk level and the security risk level exceed a predefined threshold according to the judgment or the result of the judgment, security risk blocking or security control is performed.

In the case of the security risk blocking or security control, a management situation occurrence event is reported to a predefined management terminal (at least one of the management terminal 1 520 and the management terminal 2 530 of FIG. 5) and the security risk is blocked or It receives an instruction (return) on whether to perform security control and operates accordingly.

The security support module 160 supports various sources for security of the monitoring / security control service server end. Here, although the security support module 160 is illustrated as an internal component of the monitoring / security control service server end in FIG. 1 for convenience, it is not limited thereto, and may be an external security support configuration. The security support module 160 reflects the results of security event analysis to perform continuous security updates, and collects information on security threats or security events from external agencies, etc. even if no actual security event occurs in the public agency's information system. And can provide various supports to prevent and respond in advance.

The security control service described in this specification may be performed by the monitoring / security control service server end in a node or link unit.

2 is a view showing the components of a monitoring / security control service server according to an embodiment of the present invention.

Referring to FIG. 2, the monitoring / security control service server unit includes a communication unit 210, an information asset data processing unit 220, a security data processing unit 230, a security analysis unit 240, a security management unit 250, and a control unit ( 260) and the database 270.

The communication unit 210 supports data communication between internal components as well as data communication with the external terminal 110. Here, the internal components include the terminal 510 and management terminals 520 and 530 of FIG. 5 to be described later.

The information asset data processing unit 220 processes requests for information asset data of the public institution information system.

According to an embodiment, the information asset data processing unit 220 processes a web site accessible through a network that records and updates and manages various IP information, that is, information asset data accessible through a website, and the information asset For access, it handles requests for access to information assets, access to information assets, etc. of the targeted person by ID and password.

The security data processing unit 230 collects security events including log data of the information asset data processing unit 220, security event information, traffic information, and various log data of the data server of the information system.

According to an embodiment, the security data processing unit 230 is based on various security control service solutions such as a firewall (VPN), intrusion detection system (IDS), intrusion prevention system (IPS), antivirus, security patch, etc. Security events for the data processing unit 220 are collected and processed.

The security analysis unit 240 analyzes security events such as access control, threat information, harmful information, patch information, and anti-virus statistical information from log data collected by the security data processing unit 230.

According to an embodiment, the security analysis unit 240 collects and analyzes threat information and harmful information that poses a risk to information assets, periodically checks the impact of infringement, periodically updates the risk level, and provides security events and risk information. It collects harmful traffic information, converts it to be usable by reducing it in a predetermined time unit, and can be in charge of infrastructure management, risk vulnerability management, and risk management.

According to an embodiment, the security analysis unit 240, from the security event and the harmful information and threat information collected by the security data processing unit 230, the access attempt information and the installation information of the security patch of the illegally controlled subject are controlled. It collects statistical information on antivirus and antivirus, and analyzes risk information that may cause damage and infringement information that may be a hacking attempt, and proposes an optimal countermeasure.

According to an embodiment, the security analysis unit 240 is composed of hardware (H / W), software (S / W), and the like, to register information or security assets, and to evaluate the value of the information or security assets Or manage security assets, manage security risk types to manage security risks, analyze the frequency of security risks and the degree of security risk impact on information systems, analyze risks associated with security vulnerability analysis results of information security systems, analyze security vulnerabilities Security management to manage history, manage security evaluation criteria, apply security measures, manage risks for information systems, manage risks, and perform statistical analysis on the status of security risks.

The security management unit 250 determines whether there is a risk from the information analyzed by the security analysis unit 240, and manages the history of hacking or infringement incidents and their history.

According to an embodiment, the security management unit 250 analyzes the frequency, crossover, correlation, etc. of risk information to detect external infringement attempts, risk occurrence status, security patch and antivirus installation status information, and infringement from outside It can collect accident reports and security status information, analyze and detect infringement incidents, manage history, and be in charge of real-time forecasting, real-time alerting, and operation management.

According to an embodiment, the security management unit 250 monitors the occurrence of security events for the public institution information system in real time, real-time management that monitors security performance in real time, analyzes security event information, retrieves security data information, and retrieves statistics. Perform reporting information analysis, detect the risk level of infringement on information assets, detect security issues, detect and analyze intrusion attacks, analyze security risk traffic against total traffic, analyze traffic by information asset service, Performs traffic analysis to analyze traffic for each institution and presents the optimal countermeasures.

The security management unit 250 also manages information assets, manages access users to the information assets, manages security environment settings, manages security event history, includes information collection target management, security events, and system log information. Security events can be separated by collecting various information, managing security events, and filtering security events according to a predefined security risk level.

The control unit 260 manages security risks analyzed by the security management unit 250 and controls the monitoring / security control service server unit as a whole.

According to an embodiment, the control unit 260 controls the data to grasp the overall security situation, including the risks and security breaches analyzed by the security management unit 250, and is related to the management terminals 520 and 530 of FIG. 5. Provide security information.

The database 270 stores various security data for protection of the information asset as well as various information assets of the public institution information system.

3 is a configuration diagram of a video system of a security control system according to an embodiment of the present invention.

3 can be viewed, for example, as a configuration diagram for a terminal that provides the security control system data processed by FIGS. 1 and 2 described above, that is, a video system.

Referring to FIG. 3, data may be transmitted from a plurality of sources to the display 320 of the terminal through the network 310.

Here, the network 310 is at least one of the wired / wireless networks described above, and for convenience, TCP / IP for data communication of an image source is taken as an example, but the present invention is not limited thereto.

Meanwhile, each network 310 between a plurality of sources and a terminal may be different.

In FIG. 3, for example, four sources from Source 1 to Source 4 are connected to the terminal through each of four channels.

At this time, the security control system data provided through each source may be simultaneously processed and provided through the display 320 in consideration of the performance of the terminal, but may be separately processed and provided separately. In the latter case, processing of each source data may be determined through the digital matrix switcher 330 of FIG. 3.

The display 320 of the terminal illustrated in FIG. 3 may divide a screen and output security control system data received from each source through each divided screen. According to an embodiment, all the divided screens do not necessarily output the security control system data.

Meanwhile, the terminal illustrated in FIG. 3 does not necessarily need to be integral with the display, and the actual terminal processing device (for convenience, processor) 340 other than the display is located remotely and is daisy-chained through a remote control or RS-232C. It is also possible to control the display by configuring.

Therefore, in FIG. 3, for convenience, the security control system data processed in each source is illustrated as being directly transmitted to the display, but is not limited thereto.

6 and 7 can be exemplified as an example of implementation of the video system of the security control system of FIG. 3.

6 is a view showing the actual implementation of the security control comprehensive situation room according to an embodiment of the present invention, Figure 7 is a view showing the actual implementation of a personal terminal according to an embodiment of the present invention.

6 and 7, according to an embodiment, each terminal only performs a separate display function, and the processor 340 may be located remotely. On the contrary, each terminal is equipped with a processor to process various data and process the processed data. May be provided through an integrated display.

However, the present invention is not necessarily limited to that shown in FIGS. 3, 6 and 7.

4 is a flowchart illustrating a security control method according to an embodiment of the present invention.

Referring to FIG. 4, the monitoring / security control service server terminal detects a real-time monitoring of a public institution's information system and security events related to security risks according to an attempt to access or access the terminal 110 (S401).

According to an embodiment, the step S401 may be performed on a node or link basis.

The monitoring / security control service server stage analyzes and reports the security event related to the security risk detected as a result of the real-time monitoring (S402).

The monitoring / security control service server class separates the security risk events from the analyzed security events, determines the security risk level of the separated security risk events, and determines the security risks based on predefined thresholds. Block the security risk (S403).

The monitoring / security control service server end reports the result of step S403 and updates the security data (S404).

In the above, the monitoring / security control service server end is related to security events detected through the security support module 160 to block security risks. You can download or update it.

Alternatively, the monitoring / security control service server end extracts relevant security data from a security database in which security data previously downloaded or updated is stored through the security support module 160 to block security risk, and uses the security risk blocking To perform. In this case, when performing the security control service after the security data update, priority is given to the latest security update data, thereby enabling quick response to the latest security issues.

The monitoring / security control service server terminal may report to at least one of the management terminals 520 and 530 of FIG. 5 in advance when the step S403 is performed, and follow the instructions of the management terminals 520 and 530 after reporting.

In addition, the result of performing the security risk blocking in step S403 may be reported to the management terminals 520 and 530 of FIG. 5 to help counter future security risk attempts or threats.

When reporting the security risk event and reporting the security risk blocking result, the monitoring / security control service server end may graphically enable the management terminals 520 and 530 to detect the security risk more intuitively and respond to the security risk. graphic), a table, a table, and the like, and an interface therefor.

When the security risk level of the separated security risk event is less than a predefined threshold, the monitoring / security control service server end may collect additional security events of the security risk event for a predefined time.

Here, the monitoring / security control service server end may judge the security risk level in comparison with the threshold based on the additional security event of the collected corresponding security risk event.

At this time, the monitoring / security control service server end may release the security risk event attribute of the corresponding security risk event if the security risk level as a result of the judgement continues to be below the threshold.

However, if the security risk level is higher than the threshold as a result of the trial, the monitoring / security control service server end reports the security risk event to the management terminals 520 and 530 and blocks the security risk.

In the above, for the convenience of explanation, once the security risk level is judged by the security risk level, the judge of the security risk level performs only once and continuously releases the attribute of the security risk event from the security risk level if the security risk level is below the threshold. It is described, but is not necessarily limited to this. For example, the security risk event as described above is recorded in the database 270 even if the security property is changed as described above, and if the security event is detected again later, the criteria for the judges are more stringent than other security risk events. You can judge it.

According to an embodiment, the database 270 stores and updates data (black list) for a security risk event in advance, and among security events, security events corresponding to the black list are preferentially separated into security risk events, and thus separated. The established security risk event may lower the threshold, which is a criterion for determining the security risk level, compared to other security risk events.

According to an embodiment, the security risk event corresponding to the black list does not determine the security risk level or reports the security risk event to the management terminals 520 and 530, even if there is no instruction from the management terminals 520 and 530 automatically. Blocking can be performed.

According to an embodiment, if a security risk is raised from a security event that does not correspond to the black list or is managed as a security risk event over a predefined number of times, the security event may be added to the black list.

According to an embodiment, although not included in the black list, a threshold for judging the security risk level is temporarily applied to a security event in which a warning or security accident has occurred in a related organization or a professional organization, or temporarily added to the black list Can be.

According to an embodiment, the security risk event corresponding to the black list may be reported to the management terminals 520 and 530 about the security risk event with the result after blocking the pre-security risk.

According to an embodiment, the security risk event corresponding to the black list may further strengthen the jurisdiction criterion to strengthen the frequency or frequency than when initially determined.

According to an embodiment, the security risk level determination and the judgment criteria may be set differently for the security risk event or the security risk event corresponding to the black list. For example, it is possible to respond to a security risk event by lowering the second threshold for the security risk level judge more than the first threshold for determining the initial security risk level.

Depending on the embodiment, the threshold for determining the security risk level may be differently applied to the public institution information system periodically or irregularly. For example, in the case of a security check date for an information system on a regular basis, even for security events that are not separated into security risk events, security check is performed by applying a higher strictness than usual, that is, a low threshold or multiple security risk level judgments. You can do

According to an embodiment, if the number or frequency of security risk blocking within a predefined day is greater than or equal to a predetermined number of times, a threshold for determining the security risk level may be arbitrarily applied from the threshold for a certain period of time.

Referring to FIG. 5, each terminal 1 to n (where n is a positive integer) 510 is a security event detection result of the monitoring / security control service server end, a security risk analysis result, a security risk blocking result, and security control Various data on service results, etc. can be output.

In addition, the output result of the terminal 510 is reported to the management terminals 520 and 530 on a periodic / aperiodic basis, and may receive and output the instruction.

Meanwhile, each of the terminals 1 to n may output a result of detecting a security event for the corresponding information in response to each node, for example, a database, a mail server, or a log server of a public institution information system.

According to another embodiment of the present invention, a security control service method includes: real-time monitoring of each node of a public institution's information system and detecting security events related to security risks according to a connection attempt or connection of a terminal; Analyzing security events related to security risks detected as a result of the real-time monitoring; Separating a security risk event from the analyzed security events, determining a security risk level of the separated security risk event, and blocking a security risk for a security event determined as a security risk factor based on a predefined threshold; And reporting the result to the management terminal, and updating the security data; wherein the security risk blocking step further comprises: transmitting an instruction request for a security event determined to be a security risk factor to the management terminal. When the security risk level of the separated security risk event is less than a predefined threshold, additional security events of the security risk event are collected for a predefined time, and the addition of the collected security risk event Based on the security event, judge the security risk level compared to the threshold, but if the result of the judgment is that the security risk level continues to be below the threshold, the security risk event attribute of the security risk event is released, and the security event Further comprising the step of storing a black list; Security events are automatically separated and managed as security risk events, and security risk events corresponding to the black list are applied without strict security risk level or by applying a threshold for strict security risk level determination. It is characterized by performing a security risk blocking.

Meanwhile, the above-described method can be implemented in a program that can be executed in a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable medium. Further, the structure of the data used in the above-described method can be recorded on a computer-readable medium through various means. Computer-readable media that store executable computer code for performing various methods of the present invention include magnetic storage media (eg, ROM, floppy disks, hard disks, etc.), optical reading media (eg, CD-ROMs, DVDs). Etc.).

Those of ordinary skill in the art related to the embodiments of the present invention will understand that it may be implemented in a modified form without departing from the essential characteristics of the above description. Therefore, the disclosed methods should be considered from an explanatory point of view rather than a restrictive point of view. The scope of the present invention appears in the claims rather than the detailed description of the invention, and all differences within the equivalent range should be interpreted as being included in the scope of the invention.

The present invention relates to a security control service, and it is possible to use the apparatus and system therefor.

Claims (10)

Real-time monitoring of each node of the public institution's information system and detecting security events related to security risks according to the access attempt or access of the terminal;
Analyzing security events related to security risks detected as a result of the real-time monitoring;
Separating a security risk event from the analyzed security events, determining a security risk level of the separated security risk event, and blocking a security risk for a security event determined as a security risk factor based on a predefined threshold; And
Reporting the result to the management terminal and updating the security data;
Security control service method comprising a.
According to claim 1,
The security risk blocking step,
And transmitting an instruction request for a security event determined to be a security risk factor to the management terminal.
According to claim 1,
If the security risk level of the separated security risk event is less than a predefined threshold, the security control service method, characterized in that for collecting the additional security events of the security risk event for a predefined time.
According to claim 3,
Judging the security risk level by comparing with the threshold based on the additional security event of the collected security risk event,
If the security risk level as a result of the jurisdiction continues to fall below the threshold, the security risk service method of the security risk event property of the corresponding security risk event.
According to claim 1,
Further comprising the step of storing the black list for the security event;
For the security event included in the black list, it is automatically separated and managed as a security risk event, and the security risk event corresponding to the black list is performed by strictly applying a threshold for determining the security risk level to perform security risk blocking or security risk. Security control service method, characterized in that to perform a security risk blocking in priority without level.
A terminal generating a security event by attempting or accessing an information system;
Management terminal; And
Detects security events related to real-time monitoring and security risks for each node of the public institution's information system according to the access attempt or connection of the terminal, analyzes security events related to security risks detected as a result of the real-time monitoring, and analyzes the Separating the security risk event from one security event, determining the security risk level of the separated security risk event, blocking the security risk for the security event determined as a security risk factor based on a predefined threshold, and And a security control service device reporting to the management terminal and updating security data.
The method of claim 6,
The security control service device,
Security control service system, characterized in that for transmitting a request for an indication of a security event determined as a security risk factor to the management terminal and performing a security control service according to the returned instruction.
The method of claim 6,
The security control service device,
If the security risk level of the separated security risk event is less than a predefined threshold, the security control service system, characterized in that for collecting the additional security events of the security risk event for a predefined time.
The method of claim 8,
The security control service device,
Judging the security risk level by comparing with the threshold based on the additional security event of the collected security risk event,
If the security risk level as a result of the jurisdiction continues to fall below the threshold, the security control service system of the security risk event property of the corresponding security risk event.
The method of claim 6,
The security control service device,
Save the black list of security events,
For the security event included in the black list, it is automatically separated and managed as a security risk event, and the security risk event corresponding to the black list is performed by strictly applying a threshold for determining the security risk level to perform security risk blocking or security risk. Security control service system, characterized in that it performs a security risk blocking in priority without level.

Images