WO2017221299A1

WO2017221299A1 - Security countermeasure determination device, security countermeasure determination method, and security countermeasure determination program

Info

Publication number: WO2017221299A1
Application number: PCT/JP2016/068266
Authority: WO
Inventors: 弘毅西川; 河内　清人
Original assignee: 三菱電機株式会社
Priority date: 2016-06-20
Filing date: 2016-06-20
Publication date: 2017-12-28
Also published as: JP6324646B1; JPWO2017221299A1

Abstract

A risk analysis unit (140) of a security countermeasure determination device (100) generates threat information (111). The threat information (111) is information that indicates, for each of a plurality of threats affecting a system (200), whether or not the system (200) meets a combination of one or more conditions under which the threat occurs, and whether or not the system (200) meets each individual condition included in this threat-causing condition combination. A countermeasure selection unit (150) of the security countermeasure determination device (100) refers to the threat information (111) and identifies a threat to be dealt with, from among the plurality of threats, on the basis of the number of conditions that are included in the threat-causing condition combination for each threat and that are not currently met by the system (200). The countermeasure selection unit (150) then selects, as a security countermeasure to be taken, a security countermeasure with which the system (200) can be changed so as not to meet at least one condition included in the threat-causing condition combination for the identified threat, said at least one condition being currently met by the system (200).

Description

Security measure determining device, security measure determining method, and security measure determining program

The present invention relates to a security measure determining device, a security measure determining method, and a security measure determining program.

Due to the spread of information society, it is important to determine appropriate security measures in order to protect internal information of companies. However, it is not easy to appropriately determine security measures because of advanced information technology, complicated system cooperation, and frequently changing network configurations. Therefore, a technology for automatically calculating the risk of the target system and determining appropriate security measures is required.

Patent Document 1 discloses a technology that collects system and asset configuration information, calculates a risk evaluation index using a logical expression that represents a threat generation condition, and implements countermeasures against vulnerable locations. Yes.

Patent Document 2 discloses a technique for finding a vulnerable part by deriving an attack tree for a system and presenting a risk mitigation measure.

Patent Document 3 discloses a technique for selecting a measure with a high risk reduction rate and selecting a measure with a low cost when the reduction rate is the same.

JP 2011-022903 A Special table 2011-519435 gazette JP 2002-24526 A International Publication No. 2009/037897

In the prior art, security measures are implemented to transition the system from a state where management is inappropriate in terms of security to a state where management is appropriate. However, in the prior art, appropriate security management is currently performed, but it is impossible to recognize a state where a potential risk exists such that a threat is generated by some procedure by an attacker. For this reason, the conventional technology cannot determine a security measure against a target-type attack in which attacks are relentlessly costly if there is a slight failure.

The present invention aims to reduce potential risks in the system.

A security measure determining apparatus according to an aspect of the present invention includes:
A combination of one or more conditions in which a threat affecting the system is generated, and threat information indicating whether the conditions included in the combination are satisfied or unsatisfied in the system are generated and generated. A risk analysis unit that stores threat information in memory;
Whether the threat is a threat to be dealt with by accessing the memory, referring to the threat information generated by the risk analysis unit, and according to the number of unsatisfied conditions included in the combination Security measures that can change at least one satisfied condition included in the combination to an unsatisfied condition if the threat is determined to be a threat to be addressed. And a measure selection section to select.

In the present invention, whether or not the threat is a threat to be dealt with is determined based on how many unsatisfied conditions are present in a combination of one or more conditions that cause a threat that affects the system. If it is determined that the threat should be dealt with, a security measure that can change at least one satisfied condition to an unsatisfied condition is selected as the security countermeasure to be implemented. Is done. For this reason, the potential risk in the system can be reduced.

FIG. 2 is a block diagram showing a configuration of a security measure determination device according to the first embodiment. 5 is a flowchart showing the operation of the security measure determining apparatus according to the first embodiment. 6 is a flowchart showing an operation example of a countermeasure selection unit of the security countermeasure determining apparatus according to the first embodiment. FIG. 4 is a block diagram illustrating a configuration of a security measure determining apparatus according to a second embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals. In the description of the embodiments, the description of the same or corresponding parts will be omitted or simplified as appropriate.

Embodiment 1 FIG.
This embodiment will be described with reference to FIGS.

*** Explanation of configuration ***
With reference to FIG. 1, the structure of the security measure determination device 100 according to the present embodiment will be described.

The security measure determining apparatus 100 is a computer. The security measure determining apparatus 100 includes a processor 101 and other hardware such as a memory 102, an auxiliary storage device 103, an input interface 104, and a screen output interface 105. The processor 101 is connected to other hardware via a signal line, and controls these other hardware.

The security measure determining apparatus 100 includes a configuration extracting unit 120, an information extracting unit 130, a risk analyzing unit 140, a measure selecting unit 150, and a measure applying unit 160 as functional elements. Functions of “units” such as the configuration extraction unit 120, the information extraction unit 130, the risk analysis unit 140, the countermeasure selection unit 150, and the countermeasure application unit 160 are realized by software.

The processor 101 is an IC that performs processing. “IC” is an abbreviation for Integrated Circuit. Specifically, the processor 101 is a CPU. “CPU” is an abbreviation for Central Processing Unit.

The threat information 111 is stored in the memory 102. The threat information 111 is information indicating a combination of one or more conditions in which a threat that affects the system 200 occurs and whether the conditions included in the combination are satisfied or not satisfied in the system 200. is there. Although the number of threats considered may be one, in the present embodiment, there are a plurality of threats. In other words, in the present embodiment, the threat information 111 includes, for a plurality of threats affecting the system 200, a combination of one or more conditions for generating each threat, and conditions included in each threat combination. This is information indicating whether the system 200 is satisfied or not satisfied. Specifically, the memory 102 is a flash memory or a RAM. “RAM” is an abbreviation for Random Access Memory.

In the auxiliary storage device 103, a countermeasure database 112 is stored. The countermeasure database 112 is a database that stores a set of cost and implementation contents for each security countermeasure that can be implemented for the system 200. The countermeasure database 112 is appropriately expanded in the memory 102 and is referred to or operated by the processor 101. The auxiliary storage device 103 further stores a program for realizing the function of “unit”. This program is loaded into the memory 102 and executed by the processor 101. The auxiliary storage device 103 also stores an OS. “OS” is an abbreviation for Operating System. The processor 101 executes a program for realizing the function of “unit” while executing the OS. A part or all of the program for realizing the function of “unit” may be incorporated in the OS. Specifically, the auxiliary storage device 103 is a flash memory or an HDD. “HDD” is an abbreviation for Hard Disk Drive.

The input interface 104 is a port to which an input device (not shown) is connected. Specifically, the input interface 104 is a USB terminal. “USB” is an abbreviation for Universal Serial Bus. Specifically, the input device is a mouse, a keyboard, or a touch panel.

The screen output interface 105 is a port to which a display (not shown) is connected. Specifically, the screen output interface 105 is a USB terminal. Specifically, the display is an LCD. “LCD” is an abbreviation for Liquid Crystal Display.

The security measure determining apparatus 100 may include a communication device as hardware.

The communication device includes a receiver that receives data and a transmitter that transmits data. Specifically, the communication device is a communication chip or a NIC. “NIC” is an abbreviation for Network Interface Card.

The security measure determining apparatus 100 may include a plurality of processors that replace the processor 101. The plurality of processors share the execution of a program that realizes the function of “unit”. Each processor is an IC that performs processing in the same manner as the processor 101.

Information, data, signal values, and variable values indicating the processing results of “unit” are stored in the memory 102, the auxiliary storage device 103, or a register or cache memory in the processor 101.

The program for realizing the function of “unit” may be stored in a portable recording medium such as a magnetic disk or an optical disk.

*** Explanation of operation ***
With reference to FIG. 2, the operation of the security measure determining apparatus 100 according to the present embodiment will be described. The operation of the security measure determining apparatus 100 corresponds to the security measure determining method according to the present embodiment. The operation of the security countermeasure determining apparatus 100 corresponds to the processing procedure of the security countermeasure determining program according to the present embodiment.

In step S11, the configuration extraction unit 120 investigates the management target system 200, and extracts system configuration information indicating the configuration of the system 200. The system configuration information includes information such as the network configuration and the OS version. As a specific example, the system configuration information is defined and acquired in the same manner as the “diagnostic item” described in Patent Document 4. The configuration extraction unit 120 inputs the extracted system configuration information to the risk analysis unit 140.

In step S12, the information extraction unit 130 investigates the system 200 to be managed, and extracts asset information indicating the arrangement of information with asset value held by the system 200. The asset information is information indicating the arrangement of information having asset value such as confidential information and customer information in the system 200 to be managed. As a specific example, asset information is defined and acquired in the same manner as “placement information” described in Patent Document 1. The information extraction unit 130 inputs the extracted asset information to the risk analysis unit 140.

In step S13, a set of the contents and cost of the security countermeasure is input to the countermeasure database 112. This input may be automatically performed by importing data, but is manually performed in the present embodiment.

In step S14 and step S15, the risk analysis unit 140 generates the threat information 111 and stores the generated threat information 111 in the memory 102. Specifically, in step S14, the risk analysis unit 140 extracts an attack tree of the management target system 200 using the system configuration information and asset information input from the configuration extraction unit 120 and the information extraction unit 130. The attack tree is a kind of risk analysis technique. As a specific example, the attack tree is defined and acquired in the same manner as that described in Patent Document 2. In step S15, the risk analysis unit 140 obtains a logical expression of the threat occurrence condition based on the attack tree. This logical expression is expressed in an additive standard form and stored in the memory 102 as threat information 111. A specific example of the logical expression of the threat generation condition will be described later.

In step S16 and step S17, the countermeasure selection unit 150 accesses the memory 102 and refers to the threat information 111 generated by the risk analysis unit 140. As described above, the threat information 111 is a combination of one or more conditions in which a threat that affects the system 200 occurs, and the conditions included in the combination are satisfied or not satisfied in the system 200. It is the information which shows. The measure selection unit 150 determines whether the threat is a threat to be dealt with according to the number of unsatisfied conditions included in the combination. When it is determined that the threat should be dealt with, the countermeasure selection unit 150 performs security countermeasures that can implement a security countermeasure that can change at least one satisfied condition included in the combination to an unsatisfied condition. Select measures. In the present embodiment, the threat information 111 includes, for a plurality of threats affecting the system 200, a combination of one or more conditions in which each threat occurs and a condition included in each threat combination. It is the information which shows whether it is satisfied in (2). Therefore, the countermeasure selection unit 150 individually determines whether each threat is a threat to be dealt with according to the number of unsatisfied conditions included in each combination of threats. That is, the countermeasure selection unit 150 identifies a threat to be addressed from a plurality of threats according to the number of unsatisfied conditions included in each threat combination. Then, the measure selection unit 150 selects a security measure that can change at least one satisfied condition included in the identified combination of threats to an unsatisfied condition as a security measure to be implemented. Specifically, in step S <b> 16, the measure selection unit 150 performs analysis based on the logical expression of the threat generation condition obtained by the risk analysis unit 140 and determines whether security measures are necessary. If a security measure is necessary, in step S17, the measure selection unit 150 refers to the measure database 112, determines which security measure can be implemented while considering the cost, and actually implements the security measure. To the countermeasure application unit 160.

In step S18, the countermeasure application unit 160 receives an instruction from the countermeasure selection unit 150, calls the actually implemented security countermeasure from the countermeasure database 112, and implements the security countermeasure on the management target system 200. As an example of the security measure, there is a measure to change the setting of the security device included in the system 200 to be managed. As a specific example, security measures are defined and implemented in the same manner as described in Patent Document 1.

With reference to FIG. 3, the operation example of the measure selection unit 150 in step S16 and step S17 will be described.

Here, the logical expression of the threat generation condition obtained in the risk analysis unit 140 is expressed as follows.
Formula 1: R = r1∨r2∨ ... ∨rn
Formula 2: ri = pi1∧pi2∧ ・・・ ∧pim _i

Expression 1 is a logical expression of threat generation conditions in the system 200 to be evaluated. When a threat occurs, R = 1, and when it does not occur, R = 0. When i = 1, 2,..., n, r _i represents each threat, and n represents the number of threats. j = 1, 2, · · ·, when the _{m i,} pij denotes one one of the conditions for threat ri occurs, the number of conditions for _{m i} is the threat ri occurs Show. As a specific example of the condition, there is a condition of being connected to a network. Here, “∨” represents a logical sum, and “∧” represents a logical product.

In step S21, the countermeasure selection unit 150 checks the value of Expression 1, which is a logical expression of the threat occurrence condition. Here, when R = 1, step S22 is executed, and when R = 0, step S23 is executed.

In step S22, the measure selection unit 150 evaluates which item is “1” and identifies the corresponding item. Here, the function f (ri) is defined as a function for counting up the number of “0” in the condition pij for the threat ri to occur. If step S22 is described using the function f (ri), ri for which f (ri) = 0 is specified. After step S22, step S24 is executed. If there are a plurality of ri specified in step S22, step S24 is executed for all corresponding ri.

In step S23, the measure selection unit 150 calculates f (ri) for all ri, and if there is a value whose calculated value is smaller than the threshold th, executes step S24. The threshold th is set to an arbitrary value larger than “0”. If there are a plurality of corresponding ri in step S22, step S24 is executed for all corresponding ri.

In step S24, the countermeasure selecting unit 150 selects a security countermeasure for dealing with the threat ri identified in step S22 or step S23, and notifies the countermeasure applying section 160 of it. The selected security measure is a procedure such that “1” is changed to “0”. As a specific example, if one of the generation conditions p11 of the threat r1 is connected to a network, “blocking the network” is selected as a security measure. When 1 <k <n and k ≠ i, the security measures to be implemented are to deal with other threats rk by implementing that one security measure, and to implement that one security measure. It is desirable that the cost of A plurality of security measures may be selected.

The selection of security measures for dealing with the threat ri identified in step S23 will be described in detail.

First, the countermeasure selection unit 150 extracts all pij whose values are “1” in ri specified in step S23. As a specific example, a case where ra is given as in the following Expression 3 will be described.
Expression 3: ra = pa1∧pa2∧pa3∧pa4∧pa5 = 1∧0∧1∧1∧0

When a function g (ri) for extracting an element having a value of “1” from ri is defined, a set E obtained by extracting an element having a value of “1” from pa from ra is represented by the following Expression 4. Become.
Formula 4: E = g (ra) = {pa1, pa3, pa4}

As described above, if ra is given by the function g (ri) as shown in Equation 3, a condition that requires security measures can be extracted for the threat ra.

Next, the countermeasure selection unit 150 selects a security countermeasure that can set one or more elements e of the set E to “0” from the countermeasure database 112. Here, the security measures to be selected are selected from two viewpoints. The first viewpoint is whether or not the number of elements e that can be set to “0” by implementing one security measure is large. This is because it is a good countermeasure that can eliminate a plurality of attack conditions with one security countermeasure. The second viewpoint is the cost required when taking security measures. The measure selection unit 150 calculates a cost necessary for implementing the security measure and preferentially selects a security measure with a low cost. Here, the cost may be time or money, and the time may be converted into money and evaluated on a common scale. As described above, the countermeasure database 112 is a database that stores a set of cost and implementation contents for each security countermeasure that can be implemented for the system 200. Therefore, it is possible to select security measures from the viewpoint of cost.

*** Explanation of the effect of the embodiment ***
With the above operation, it is possible to identify a potential risk in the system 200 to be managed, implement security measures based on the result, and keep the system 200 safe. In other words, according to the present embodiment, it is possible to ensure safety against targeted attacks by identifying potential risks for the management target system 200 and automatically performing security measures.

In the present embodiment, whether or not a threat is a threat to be dealt with is determined based on how many unsatisfied conditions exist in a combination of one or more conditions that cause a threat that affects the system 200. Is done. If it is determined that the threat should be dealt with, a security measure that can change at least one satisfied condition to an unsatisfied condition is selected as the security countermeasure to be implemented. Is done. Thus, potential risks in the system 200 can be reduced.

In the present embodiment, the countermeasure selection unit 150 compares the number of unsatisfied conditions included in the combination of the conditions pij in which each threat ri occurs with a threshold th greater than “0”, and the threshold th A threat ri that includes a small number of unsatisfied conditions in the combination is identified as a threat to be dealt with. Therefore, even when the risk of threats is not obvious, it is possible to detect and deal with potential risks.

In the present embodiment, the countermeasure selection unit 150 gives priority to a security countermeasure that can change two or more satisfied conditions included in a combination of conditions in which the identified threat occurs to two or more unsatisfied conditions. Select security measures to be implemented. Desirably, the countermeasure selection unit 150 should prioritize security countermeasures that can change the satisfied conditions included in the combination of the conditions for generating the identified threats to more unsatisfied conditions. Select security measures. Thereby, an increase in the number of security measures to be implemented can be suppressed.

In the present embodiment, the countermeasure selection unit 150 selects a security countermeasure to be implemented with priority given to a security countermeasure implemented at a lower cost. Thereby, the increase in the cost concerning implementation of a security measure can be suppressed.

*** Other configurations ***
In the present embodiment, the function of “unit” is realized by software. However, as a modification, the function of “unit” may be realized by a combination of software and hardware. That is, a part of the function of “unit” may be realized by a dedicated electronic circuit, and the rest may be realized by software.

Specifically, the dedicated electronic circuit is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an FPGA, or an ASIC. “GA” is an abbreviation for Gate Array. “FPGA” is an abbreviation for Field-Programmable Gate Array. “ASIC” is an abbreviation for Application Specific Integrated Circuit.

The processor 101, the memory 102, and the dedicated electronic circuit are collectively referred to as a “processing circuit”. That is, regardless of whether the function of “part” is realized by software or a combination of software and hardware, the function of “part” is realized by a processing circuit.

“Part” may be read as “Process”, “Procedure”, or “Process”.

Embodiment 2. FIG.
The difference between the present embodiment and the first embodiment will be mainly described with reference to FIG.

The security measure determining apparatus 100 includes a configuration extracting unit 120, an information extracting unit 130, a risk analyzing unit 140, a measure selecting unit 150, a measure applying unit 160, and an impact reflecting unit 170 as functional elements. Functions of “units” such as the configuration extraction unit 120, the information extraction unit 130, the risk analysis unit 140, the countermeasure selection unit 150, the countermeasure application unit 160, and the influence reflection unit 170 are realized by software.

In any service provided by the system 200 to be managed, in order to give convenience to the user and the like, pij in the above-described expression 2 is currently “0” and safe, but unless the pij is set to “1”. It may not be possible. However, if the value of ri becomes “1” by setting pij to “1”, another pij must be set to “0” in ri. Therefore, the influence reflecting unit 170 changes pij that needs to be “1” to “1”. The contents of this change are input to the risk analysis unit 140, and thereafter, the same processing as in the first embodiment is performed.

That is, the impact reflection unit 170 is a condition that should be satisfied in the system 200 in order for the system 200 to provide a service among unsatisfied conditions included in a combination of one or more conditions in which a threat occurs. The information is changed to information indicating that the essential condition is satisfied in the system 200. The countermeasure selecting unit 150 refers to the threat information 111 after being changed by the influence reflecting unit 170, and determines whether or not the threat is a threat to be dealt with. When it is determined that the threat is to be dealt with, the countermeasure selecting unit 150 changes at least one condition different from the essential condition among the satisfied conditions included in the combination to an unsatisfied condition. Select security measures that can be implemented as security measures to be implemented. Although the number of threats considered may be one, in the present embodiment, there are a plurality of threats. Therefore, the impact reflection unit 170 satisfies the threat information 111 generated by the risk analysis unit 140 in the system 200 in order for the system 200 to provide a service among unsatisfied conditions included in each threat combination. The information is changed to information indicating that the indispensable condition, which is a condition to be performed, is satisfied in the system 200. The countermeasure selecting unit 150 refers to the threat information 111 after being changed by the influence reflecting unit 170 and identifies a threat to be dealt with. Then, the countermeasure selection unit 150 can change at least one condition different from the essential condition among the satisfied conditions included in the combination of the conditions in which the identified threat occurs to an unsatisfied condition. Select security measures as security measures to be implemented.

Through the above operation, it is possible to safely provide some service provided by the system 200 to be managed.

In the present embodiment, as in the first embodiment, the function of “unit” is realized by software. However, as in the modification of the first embodiment, the function of “unit” is software and hardware. It may be realized by a combination.

Although the embodiments of the present invention have been described above, two or more embodiments of these embodiments may be combined. Alternatively, among these embodiments, one embodiment or a combination of two or more embodiments may be partially implemented. Specifically, only some of the functional elements of the security countermeasure determining apparatus 100 according to these embodiments may be employed. In addition, this invention is not limited to these embodiment, A various change is possible as needed.

100 security countermeasure determination device, 101 processor, 102 memory, 103 auxiliary storage device, 104 input interface, 105 screen output interface, 111 threat information, 112 countermeasure database, 120 configuration extraction unit, 130 information extraction unit, 140 risk analysis unit, 150 Countermeasure selection section, 160 countermeasure application section, 170 impact reflection section.

Claims

A combination of one or more conditions in which a threat affecting the system is generated, and threat information indicating whether the conditions included in the combination are satisfied or unsatisfied in the system are generated and generated. A risk analysis unit that stores threat information in memory;
Whether the threat is a threat to be dealt with by accessing the memory, referring to the threat information generated by the risk analysis unit, and according to the number of unsatisfied conditions included in the combination Security measures that can change at least one satisfied condition included in the combination to an unsatisfied condition if the threat is determined to be a threat to be addressed. A security measure determination device including a measure selection unit to be selected.
The measure selection unit compares the number of unsatisfied conditions included in the combination with a threshold value greater than 0, and the combination includes fewer unsatisfied conditions than the threshold value. The security measure determining apparatus according to claim 1, wherein the threat is determined to be a threat to be dealt with.
The said countermeasure selection part selects the security countermeasure which should be implemented giving priority to the security countermeasure which can change the satisfying conditions included in the said combination into two or more unsatisfied conditions. 2. The security measure determination device according to 2.
The said countermeasure selection part gives priority to the security countermeasure which can change the satisfying conditions contained in the said combination into more unsatisfied conditions, and selects it as the security countermeasure which should be implemented. Security measure decision device.
The security measure determining device according to any one of claims 1 to 4, wherein the measure selection unit selects a security measure to be implemented by giving priority to a security measure to be implemented at a lower cost.
Among the unsatisfied conditions included in the combination, threat conditions generated by the risk analysis unit are essential conditions that are conditions that should be satisfied in the system in order for the system to provide services. In addition, an impact reflecting unit for changing to information indicating that
The countermeasure selecting unit refers to the threat information after being changed by the influence reflecting unit, determines whether the threat is a threat to be addressed, and determines that the threat is a threat to be addressed, A security measure capable of changing at least one condition different from the essential condition among satisfied conditions included in the combination to an unsatisfied condition is selected as a security countermeasure to be implemented. The security measure determination device according to any one of 1 to 5.
The risk analysis unit includes a combination of one or more conditions in which a threat affecting the system is generated, and threat information indicating whether the conditions included in the combination are satisfied or unsatisfied in the system. Generate, store the generated threat information in memory,
The measure selection unit refers to the threat information stored in the memory, determines whether the threat is a threat to be dealt with according to the number of unsatisfied conditions included in the combination, When it is determined that the threat should be dealt with, a security measure that selects a security measure that can change at least one satisfied condition included in the combination to an unsatisfied condition is selected as a security measure to be implemented Decision method.
On the computer,
A combination of one or more conditions in which a threat affecting the system is generated, and threat information indicating whether the conditions included in the combination are satisfied or unsatisfied in the system are generated and generated. Storing threat information in memory;
With reference to the threat information stored in the memory, it is determined whether the threat is a threat to be dealt with according to the number of unsatisfied conditions included in the combination, and the threat to be dealt with If it is determined that there is a security measure that executes a process for selecting a security measure that can be changed to at least one unsatisfied condition included in the combination as a security measure to be implemented Decision program.