KR20230102909A - Apparatus and method for modeling cyber threat of ship - Google Patents

Abstract

According to an embodiment of the present invention, the contents of CAPECs obtained through two methods are collected and displayed as a list, and the main threat ("OBJECTIVE1") and the upper threat ("OBJECTIVE2") are classified based on the CVSS value in relation to the CAPEC. ), a goal ("GOAL") is derived, the goal is a countermeasure derived through cyber security threat modeling, and the countermeasure corresponds to the minimum action plan to reduce the threat.

Description

Ship cyber threat modeling method and apparatus {APPARATUS AND METHOD FOR MODELING CYBER THREAT OF SHIP}

The present invention relates to a method and apparatus for modeling a cyber threat of a ship.

Recently, ships in operation are using various IT/OT systems such as electronic chart systems and automatic location identification devices, so security elements that consider ship construction and navigation environments are required. However, cyber security research on ship and shipbuilding ICT equipment industries is still insufficient, and it is threatened by a large amount of security threat information.

Most of the security problems caused by this security threat information are due to software vulnerabilities. Security vulnerabilities inherent in software can be easily exploited to attack the software or hardware of a computer system.

Attackers can perform malicious actions by identifying insecure web services with internet scanning tools. Therefore, security administrators must be able to prevent malicious attacks using disclosed vulnerabilities in advance.

Security vulnerabilities are properties that can cause security accidents derived from fundamental problems in the software field, and when hackers exploit security vulnerabilities, they materialize into security vulnerabilities and can cause security accidents.

Korean Patent Publication No. 2003-0051605 (2003.06.25.)

An object of the present invention is to provide a method and apparatus capable of modeling cyber threats to ships.

Other objects of the present invention will become more apparent from the following detailed description and accompanying drawings.

According to an embodiment of the present invention, the contents of CAPECs obtained through two methods are collected and displayed as a list, and the main threat ("OBJECTIVE1") and the upper threat ("OBJECTIVE2") are classified based on the CVSS value in relation to the CAPEC. ), a goal ("GOAL") is derived, the goal is a countermeasure derived through cyber security threat modeling, and the countermeasure corresponds to the minimum action plan to reduce the threat.

According to an embodiment of the present invention, it is possible to model cyber threats to ships.

1 is a view showing a drawing of a ship as a modeling target.
Figure 2 is a block diagram showing the acquisition of a drawing of a ship.
3 is a block diagram showing a DFD configuration.
4 is a block diagram showing attribute settings.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to FIGS. 1 to 4 attached. Embodiments of the present invention may be modified in various forms, and the scope of the present invention should not be construed as being limited to the embodiments described below. These embodiments are provided to explain the present invention in more detail to those skilled in the art to which the present invention pertains. Accordingly, the shape of each element shown in the drawings may be exaggerated to emphasize a clearer explanation.

A method for modeling cyber threats to ships is described as follows.

1. Setting the scope of analysis

The manager input unit means a means for inputting data or information, such as a keyboard, mouse, scanner, or portable storage device, and a drawing of a ship to be modeled (see FIG. 1) can be obtained through the manager input unit (110 in FIG. 2). . For example, a drawing of a ship may be obtained via a scanner or portable storage device by a security officer.

In addition, information on the vessel to be modeled (for example, the number of compartments included in the vessel, the name of the vessel, etc.) is input through the manager input unit (120 in FIG. 2), and the security manager inputs the information using a keyboard or mouse. can be entered. Specifically, cyber threat modeling for a network built in a ship is performed based on compartments of the ship, and may be independently performed according to each compartment. Therefore, the number of windows for modeling work is determined according to the input number of compartments, and separate modeling can be performed in each window.

In addition, the compartment area is set on the drawing of the ship through the manager input unit (130 in FIG. 2), and the number of compartment areas set is determined according to the previously input vessel information (number of compartments). Specifically, the area of the compartment is shown overlapping in the form of a block on the drawing. In this process, the zone location of the compartment is set (140) and displayed on the ship's plan (150).

2. DFD (Data Flow Diagram) configuration

Next, the DFD for the previously set analysis range is configured. A DFD includes nodes representing assets and flows representing data flows.

Specifically, in the method of constructing a DFD, a stencil representing the property of an asset is set (210), a component is drawn through the stencil (220), and a data flow between components is displayed by drawing a flow (230). Specifically, a stencil means a process, data store, actor, data flow, and the like.

3. Setting properties for components

Next, the property of the asset is set, and the property can be set for each stencil.

Specifically, in the case of a process, it can be set as a function/application/system item, and the function is whether a login function is present for the asset, whether a password is required, whether wifi is available, and whether a USB port exists whether or not can be set. In the case of an application, information on an operating system (eg, windows 7, etc.) may be set. In the case of a system, it can be set for a desktop, a laptop, and the like. In the case of storage, it can be set as an item of function/application/system in the same way as process.

In addition, in the case of data flow, it corresponds to the protocol for the communication method between nodes, that is, it can be set for udp, tcp, etc., and in the case of actor, it represents the manager using the storage or process, and the item of authority / function Each can be set, and the authority can be set for whether communication is through a manager with access authority, communication through an anonymous manager, or communication through a manager inside or outside the ship.

4. Threat Assessment

Evaluate threats based on the DFDs and attributes described above. Specifically, vulnerability information can be accessed and downloaded from NVD (nvd.nist.gov) based on the previously configured DFD and properties, particularly information set in the application items of the process. NVD is a database that provides information on vulnerabilities and can be easily accessed and downloaded using the HTTP protocol. Vulnerability information may include CVE, CWE, CVSS, CAPEC, etc., and a result of matching vulnerability information is generated (420, 430).

In this regard, the National Vulnerability Database (NVD) provides Common Vulnerabilities and Exposures (CVE) information so that known security vulnerability information can be easily shared. CVE provides a reference method for information on security vulnerabilities of software packages, and includes vulnerability overview, risk score (Common Vulnerability Scoring System, CVSS), vulnerability product name (Common Platform Enumeration, CPE), and vulnerability type (Common Weakness Enumeration, CWE). ), and so on. Software vulnerability analysis is performed based on the contents corresponding to the vulnerability definition information defined in CWE and CVE.

CWE is a collection of software vulnerabilities classified from various perspectives by MITRE with the support of the National Cyber Security Division within the U.S. Department of Homeland Security. CVE is a collection of security vulnerabilities detected over time. As an organized list, CWE is a classification system for general vulnerabilities, while CVE is a historical record of discovered security vulnerabilities.

In addition, CVE was first created and operated in 1999 by MITRE, an American non-profit company. Since then, the National Institute of Standards and Technology (NIST) has created NVD and systematized it while building a cooperative system. The CVE code is generated by combining the letter 'CVE' with the year the vulnerability was discovered and a random number. For example, the CVE value is denoted as "CVE-YYYY-NNNN". Here, the arbitrary number is not limited to 4 digits and may be a number of 5 digits or more.

In addition, based on the process function/system item settings, storage function/system item settings, data flow settings, and actor authority/function settings, the contents of CAPEC are retrieved from the NVD database and the above settings are Produces a CAPEC result that matches .

6. Mitigation measures

The contents of the CAPEC obtained through the above two methods are collected and displayed as a list, and the main threat ("OBJECTIVE1"), the top threat ("OBJECTIVE2"), and the target ("GOAL") are displayed based on the CVSS value in relation to the CAPEC. ) is derived. Ultimately, the goal is a countermeasure derived through cyber security threat modeling, and the countermeasure corresponds to the minimum action plan to reduce the threat.

Afterwards, a report is output by deriving policy management and technique based on the goal, and 'CVE', 'CWE', 'CAPEC', 'OBJECTIVE2', 'OBJECTIVE1', ' Reports on 'GOAL' can identify threats.

Although the present invention has been described in detail through preferred embodiments, other forms of embodiments are also possible. Therefore, the spirit and scope of the claims set forth below are not limited to the preferred embodiments.

Claims (1)

A cyber threat modeling method that collects and displays the contents of CAPEC as a list, and derives the main threat ("OBJECTIVE1"), top threat ("OBJECTIVE2"), and goal ("GOAL") based on the CVSS value in relation to the CAPEC.

Images