WO2018016798A1

WO2018016798A1 - Security management device and security management method for managing security of client terminal

Info

Publication number: WO2018016798A1
Application number: PCT/KR2017/007526
Authority: WO
Inventors: 박영민; 정일철; 이용헌
Original assignee: 주식회사 안랩
Priority date: 2016-07-19
Filing date: 2017-07-13
Publication date: 2018-01-25
Also published as: KR101930941B1; KR20180009520A; JP6728468B2; JP2019523491A

Abstract

A security management device according to one embodiment comprises: a communication unit for receiving an attribute value used for determining the security of a client terminal from the client terminal; a storage unit for storing an attribute standard, which is the standard for determining the security of the client terminal; and a determination unit for comparing the attribute standard with the attribute value and determining the security of the client terminal on the basis of the compared result.

Description

Security management device and security management method for managing the security of the client terminal

The present invention relates to a security management apparatus and a security management method for managing security of a client terminal. In more detail, an attribute value used to determine the security of the client terminal is received from the client terminal, and an administrator who manages the security of the client terminal generates an attribute criterion, and the attribute criterion thus generated is received. The present invention relates to a security management apparatus and a security management method for determining and managing security of a client terminal based on the comparison with a value and a result of the comparison.

A group having a plurality of members, such as an enterprise, may be provided with a plurality of computers (hereinafter referred to as client terminals) according to the number of members. This group of network managers manages security of a plurality of client terminals. For example, the administrator should be able to determine whether the security setting of the client terminal is vulnerable to a virus, and should be able to change the security setting of the client terminal vulnerable to a virus so as not to be vulnerable to a virus.

As a method of managing the security of the client terminal, the following technique may be exemplified. The security management server managing the plurality of client terminals generates a security policy, which is a criterion for determining the security of the client terminal, and delivers the security policy to the client terminal where the agent is installed. The agent determines the security of the client terminal based on the security policy received from the security management server. The result of the security of the client terminal determined by the agent is transmitted to the security management server.

According to the above-described technology, the security management server receives only the result of the security determined by the agent from the client terminal. In this case, the security management server may know which client terminal is a poor security terminal based on the received result and which security policy is a security policy determined to be poor security. Based on the security policy determined to be inferior in security, the security management server transmits a measure to complement the security of the client terminal to the client terminal. However, the security management server may not know whether or not it is determined that the security is not good because the client terminal has any attribute value with respect to the security policy.

In addition, when the security policy has been changed in the above-described technology and it is necessary to determine the security of the client terminal based on the changed security policy, the security management server must deliver the changed security policy back to the client terminal. Thereafter, when the agent installed in the client terminal determines the security based on the changed security policy, the client terminal transmits the result to the security management apparatus. Only in this case, the security management device can check the security of the client terminal according to the changed security policy.

An object to be solved according to an embodiment is to provide a technique for acquiring an attribute value of a client terminal in an apparatus for managing security of the client terminal, and determining the security of the client terminal in the security management apparatus based on this.

In addition, to determine the security of the client terminal to provide a technology that allows the administrator to manage the security criteria of the plurality of client terminals to create or modify the attribute criterion that is the criterion.

However, the problem to be solved is not limited to the above-mentioned purpose.

According to an embodiment, a security management apparatus includes a communication unit configured to receive an attribute value used to determine security of the client terminal from a client terminal, and a storage unit configured to store attribute criteria as a reference for determining security of the client terminal. And a determination unit comparing the attribute criterion with the attribute value and determining the security of the client terminal based on the result of the comparison.

The storage unit may store a list of at least two attribute items that the security management apparatus transmits to the client terminal, and the communication unit may be configured to display the attribute items in response to the list of the attribute items being transmitted to the client terminal. An attribute value corresponding to each attribute item included in the list may be received from the client terminal.

The security management apparatus may further include an interface unit for receiving a list of the property items from an administrator of the security management apparatus.

In addition, the attribute criterion may be a criterion for determining the security of the client terminal and may represent a method of combining a plurality of attribute values.

The apparatus may further include an interface unit configured to receive a method of combining a plurality of attribute values from an administrator of the security management apparatus.

The storage unit may store a list of reference identification information for identifying a client terminal on which an agent for identifying an attribute value of the client terminal and transmitting the same to the security management apparatus when the plurality of client terminals exist. When a list of acquisition identification information for identifying a client terminal that has sent a packet to the client terminal is received from the client terminal of any of the plurality of client terminals via the communication unit, the list of the acquisition identification information and the reference identification information The list may be compared, and it may be determined whether the agent is installed in each of the plurality of client terminals based on a result of comparing the list of the acquisition identification information with the list of the reference identification information.

In addition, the packet may be an Address Resolution Protocol (ARP) broadcast packet.

The storage unit may store a list of reference identification information for identifying a client terminal on which an agent for identifying an attribute value of the client terminal and transmitting the same to the security management apparatus when the plurality of client terminals exist. When a list of acquisition identification information for identifying the plurality of client terminals is received through the communication unit from a mirroring server that receives TCP / IP packets from a plurality of client terminals, the list of the acquisition identification information and the list of the reference identification information are determined. The comparison may determine whether the agent is installed in each of the plurality of client terminals based on a result of comparing the list of the acquisition identification information with the list of the reference identification information.

The apparatus may further include a controller configured to control an action applied to the client terminal to be transmitted to the client terminal through the communication unit according to the determined security of the client terminal.

In addition, the action may include a command for limiting the connection of the client terminal to the network or a command for the display unit included in the client terminal to display a message for improving security.

The determining unit may determine the security of the client terminal for each of the plurality of attribute criteria when the attribute criteria are plural, and the security management apparatus may determine the security of the client terminal determined for each of the plurality of attribute criteria. The control unit may further include a control unit calculating a security index of the client terminal by converting to the sum of the numbers.

The apparatus may further include a display unit displaying a security index of the client terminal.

The method may further include a controller configured to control the process of receiving the attribute value through the communication unit and determining the security of the client terminal by the determination unit according to a predetermined schedule.

The display apparatus may further include a display unit indicating that modification of the attribute criterion is necessary when the attribute criterion is not determined by the determination unit as a result of comparing the attribute value with the attribute value.

In addition, if the security criteria of the client terminal is not determined as a result of comparing the attribute criteria with the attribute value by the determination unit, the communication unit is further configured to modify the attribute criteria to the management server managing the security management apparatus. The controller may further include a controller configured to modify the attribute criteria stored in the storage unit to the received attribute criteria when the request is made through the communication unit and the modified attribute criteria are received through the communication unit.

The security management method performed by the security management apparatus according to an embodiment may include receiving an attribute value used to determine the security of the client terminal from a client terminal, and a criterion for determining the security of the client terminal. The method may include comparing the pre-stored attribute criteria with the attribute value, and determining the security of the client terminal based on the result of the comparison.

According to an embodiment of the present disclosure, when it is necessary to newly create or change an attribute criterion that is a criterion in determining the security of a client terminal, the generation or change of the attribute criterion to a developer who has developed a security management apparatus, that is, a management server. Administrators can create or change attribute criteria on their own without requesting a request.

In addition, the security management device receives and stores the attribute value used to determine the security of the client terminal from the client terminal. Therefore, when an attribute criterion is newly generated or changed, the security management apparatus may determine the security of the client terminal by comparing the stored attribute value with the generated or changed attribute criterion. That is, the security management apparatus does not need to deliver the generated or changed attribute criteria to be applied to the client terminal.

1 is a diagram illustrating a system in which security of a client terminal is managed by a security management apparatus according to an exemplary embodiment.

FIG. 2 is a diagram illustrating a configuration of the security management apparatus shown in FIG. 1.

3 is a diagram illustrating a procedure of determining security of a client terminal by a security management apparatus according to an exemplary embodiment.

4 is a diagram illustrating each step of the security management method according to an embodiment.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

Referring to FIG. 1, the system 10 is configured to include a plurality of client terminals 200, a security management apparatus 100, and a management server 300, and may be configured to include a mirroring server 400 according to an embodiment. Although, the security management apparatus 100 may not be interpreted to operate only in the system shown in FIG. 1. The aforementioned components of the system 10 are connected to each other by the network 500. The network 500 may be implemented with, for example, the Internet, a local area network (LAN), a wireless local area network (WLAN), a wide area network (WAN), a personal area network (PAN), but is not limited thereto. Do not.

The client terminal 200 may include a desktop such as a personal computer (PC), a notebook, a laptop, a server, a mobile terminal or a smart device, but is not limited thereto. The client terminal 200 may be configured in plurality.

Looking at the client terminal 200 in more detail, the client terminal 200 has an attribute value corresponding to the attribute item. The attribute item represents a hardware or software configuration of the client terminal 200. For example, the OS type or version, information on the registry, access authority to the registry, file attributes or rights, information or authority on folders, hardware This may mean information about, authority, or account information. At least two of these attribute items form a list. The attribute value may mean a specific value of the attribute item, and may mean, for example, that the OS is Windows or Linux, or that the file version is 1.1 or 1.3. The attribute value may be set or changed by the user of the client terminal 200 or the security management apparatus 100.

An agent may be installed in the client terminal 200. The agent may perform a process related to security of the client terminal 200. For example, when the client terminal 200 receives an action for enhancing security from the security management apparatus 100, the agent may execute such an action. In addition, the agent may obtain an attribute value of the client terminal 200. For example, when the client terminal 200 receives a list of attribute items from the security management apparatus 100, the agent may obtain attribute values corresponding to the attribute items included in the list of attribute items from the client terminal 200. have.

The management server 300 is a configuration for managing the security management device 100. For example, the management server 300 may generate a manner in which the security management apparatus 100 operates, and change the manner in which the security management apparatus 100 operates according to a situation. Such management server 300 may be, for example, a computer.

The mirroring server 400 will be described later.

The security management apparatus 100 determines and manages security of the client terminal 200. The security management apparatus 100 may be implemented as a desktop, a notebook, a laptop, a server, a mobile terminal, or a smart device such as a personal computer, but is not limited thereto. no. Hereinafter, the security management apparatus 100 will be described in more detail.

2 is a diagram illustrating a configuration of a security management apparatus according to an embodiment.

Referring to FIG. 2, the security management apparatus 100 includes a communication unit 110, a storage unit 120, and a determination unit 150, and according to an embodiment, the display unit 130, the interface unit 140, and the controller 160 may further include.

The communication unit 110 allows the security management apparatus 100 to transmit and receive data with the client terminal 200 or the management server 300. The communication unit 110 may be implemented as a wired or wireless communication module.

The storage unit 120 stores data. For example, the storage 120 may store at least one list of attribute items, attribute values of the client terminal 200, or attribute criteria, respectively, but the data to be stored is not limited thereto. Here, the attribute criterion refers to a method of determining the security of the client terminal 200 by combining attribute values. The storage unit 120 may be implemented as a memory that stores data.

The display unit 130 outputs text or an image. For example, the display unit 130 may display the security state of the client terminal 200 as a security index using numbers or colors. In addition, the display unit 130 may display a message related to security of the client terminal 200 to an administrator of the security management apparatus 100. In addition, although the display unit 130 will be described later, the interface unit 140 may be displayed. The display unit 130 may be implemented as an output device such as a monitor.

The interface unit 140 provides an interface that allows an administrator to select an attribute item. In this case, the manager may select an attribute item corresponding to his intention from all the attribute items related to the client terminal 200 using the interface unit 140. In addition, the interface unit 140 may provide an interface for adding a new selection item to an existing attribute item and an interface for changing or deleting the existing selection item. The interface unit 140 is displayed on the display unit 130 using text or an image, and can be implemented by a memory for storing instructions programmed to perform the above-described functions, and a microprocessor for performing the instructions.

In addition, the interface unit 140 provides an interface for the administrator to create or change attribute criteria. The attribute criterion represents a method of determining the security of the client terminal 200 by combining attribute values as described above. For example, the administrator uses the interface unit 140, and the security is good when the OS type is Windows, the version of Registry A is 1.0, and the process is B. If any one of the attribute values is different, the security is good. Attribute criteria may be created that are not good.

According to this, when there is a need to create or change the attribute criteria, the administrator has developed the security management apparatus 100, that is, the administrator without the request to modify the management server 300 in FIG. You can create or change attribute criteria yourself.

The determination unit 150 may be implemented by a memory that stores instructions programmed to perform a function to be described below, and a microprocessor that executes the instructions.

Looking at the determination unit 150 in detail, the determination unit 150 compares the attribute value stored in the storage unit 120 with the attribute value of the client terminal 200 received through the communication unit 110, the comparison result Based on the determination of the security of the client terminal 200. The determination unit 150 determines whether the attribute value meets the attribute criteria, and accordingly determines the security of the client terminal 200.

Accordingly, the security of the client terminal 200 is determined by the comparison by the determination unit 150 of the security management apparatus 100, that is, the comparison of the attribute value stored in the storage unit 120 and the attribute criteria. Therefore, when the attribute criteria need to be generated or changed, simply changing the attribute criteria stored in the storage 120 of the security management apparatus 100 may determine the security by using the attribute values stored in the storage 120. Can be enabled. That is, in order for the newly generated or changed attribute criteria to be applied to the client terminal 200, there is no need to transmit such attribute criteria to the client terminal 200 as in the related art.

On the other hand, when the plurality of client terminals 200 as shown in the system 10, the agent may be installed in only some of the client terminal 200 of the plurality of client terminals 200. The client terminal 200 without the agent installed is connected to the network 500 shown in FIG. 1. However, due to the non-installation of the agent, the security management apparatus 100 may not obtain an attribute value from the client terminal 200, and thus may not manage the security of the client terminal 200.

Therefore, the manager should be able to identify the client terminal 200 in which the agent is not installed among the client terminals 200. The determination unit 150 may determine whether an agent is installed in the client terminal 200 in the following manner. First, the storage unit 120 stores, in the form of a list, reference identification information identifying a client terminal in which an agent is installed among the plurality of client terminals 200. The reference identification information may be for example IP.

In addition, any one of the plurality of client terminals 200 is designated as the specific client terminal 200. The subject to designate may be the determiner 150 or the controller 160 included in the security management apparatus 100, which will be described later. The controller 160 transmits a command to the specific client terminal 200 to cause the designated specific client terminal 200 to receive a packet from the remaining client terminal 200 except for the specific client terminal 200. The packet at this time may be an Address Resolution Protocol (ARP) broadcast packet. In addition, the specific client terminal 200 and the remaining client terminals 200 may be client terminals connected to the same subnet.

The specific client terminal 200 obtains acquisition identification information, for example, IP, that identifies the remaining client terminal 200 from a packet received from the remaining client terminal 200, and the security management apparatus in the form of a list To 100. The determination unit 150 compares the list of acquisition identification information with the list of reference identification information stored in the storage unit 120. As a result of the comparison, when there is acquisition identification information included in the list of acquisition identification information but not included in the list of reference identification information, the determination unit 150 does not have an agent installed in the client terminal corresponding to the acquisition identification information. I do not think.

That is, according to one embodiment, it is possible to identify a client terminal that does not manage security because no agent is installed.

Meanwhile, the determination unit 150 may determine a client terminal where an agent is not installed by using a TCP / IP packet rather than an Address Resolution Protocol (ARP) broadcast packet. To this end, as shown in FIG. 1, the system 10 may be configured to include a mirroring server 400. The mirroring server 400 is connected to the network 500 and collects TCP / IP packets transmitted and received by the plurality of client terminals 200 through the network 500. The mirroring server 400 obtains acquisition identification information, for example, IP, that identifies the plurality of client terminals 200 from the collected TCP / IP packets, and transmits the acquisition identification information to the security management apparatus 100 in the form of a list. do.

The determination unit 150 compares the list of acquisition identification information with the list of reference identification information stored in the storage unit 120. As a result of the comparison, when there is acquisition identification information in the list of acquisition identification information but not in the list of reference identification information, the determination unit 150 determines that no agent is installed in the client terminal corresponding to the acquisition identification information.

The controller 160 performs overall control of the above-described components included in the security management apparatus 100, and may be implemented by a memory for storing instructions programmed for the control and a microprocessor that executes the instructions. .

In more detail, the controller 160 may calculate the security of the client terminal 200 as a security index that is a number. To this end, the controller 160 converts the result of the determination of the security of the client terminal 200 into numbers for each of the plurality of attribute criteria, and adds the converted numbers for each of the plurality of attribute criteria. It can be calculated as a security index. However, this method of calculating the security index is merely illustrative. The security index calculated by the controller 160 may be displayed on the display unit 130 described above. At this time, the change of the security index over a certain time interval may be displayed in the form of a graph or exponentially through the display unit 130.

The controller 160 may control the client terminal 200 to take an action that complements the security of the client terminal 200. In this regard, the storage unit 120 stores an action for the client terminal 200 having low security. Such measures include, for example, a command for restricting the connection of the client terminal 200 to the network 500, a command for displaying a message for improving security on the display unit of the client terminal 200, and a low security client terminal. It may include a command for changing the attribute value of 200 to a high security attribute value, but is not limited thereto. If it is determined that the security of the client terminal 200 is low by the determination unit 150, the control unit 160 controls to transmit the action stored in the storage unit 120 to the client terminal 200 through the communication unit 110. do. In this case, the controller 160 may control the action to be applied only to the client terminal 200 having a low security index by using the security index of the client terminal 200.

The controller 160 is a process of receiving the attribute value of the client terminal 200 through the communication unit 110 and a process of determining the security of the client terminal 200 by the determination unit 150 based on the received attribute value. This can be controlled to be performed according to a predetermined schedule. Here, the predetermined schedule may be set or changed by the interface unit 140.

The controller 160 processes the case where the determination unit 150 fails to determine the security of the client terminal 200. In detail, the determination unit 150 may fail to determine the security of the client terminal 200. For example, when the attribute criterion indicates that the security level is good when the version of the registry A is 0.0 or more and 5.0 or less, and the security level is low when the version is more than 5.0, the determination unit when the version of the registry A in the property value is -0.1 150 cannot determine the security. Alternatively, if only the property reference is defined for the version of the registry A, but the attribute value includes only the version of the registry B, not the registry A, the determination unit 150 cannot determine the security.

In this case, the controller 160 may control the display 130 to display a message indicating that the attribute criteria need to be corrected. For example, the controller 160 may control the display unit 130 to display a message of generating a property criterion for the registry B using the interface unit 140.

In contrast, the controller 160 may control the management server 300 that manages the security management apparatus 100 to request modification of the attribute criteria through the communication unit 110. When the modified attribute criteria are received through the communication unit 110, the controller 160 may modify the attribute criteria stored in the storage 120 as the received attribute criteria.

Through this, the administrator can be notified whether the attribute criteria need to be changed or whether new attribute criteria need to be created. That is, by using the security management apparatus according to an embodiment, the administrator may be provided with guidelines for generating attribute criteria.

Referring to FIG. 3, the communication unit 110 of the security management apparatus 100 transmits a list of attribute items to the client terminal 200 (S100). The agent included in the client terminal 200 obtains an attribute value corresponding to at least one attribute item included in the list of attribute items from the client terminal 200 (S110). The client terminal 200 transmits the attribute value to the security management apparatus 100 (S120).

The determination unit 150 of the security management apparatus 100 compares attribute values received from the client terminal 200 with attribute criteria input from an administrator of the security management apparatus 100 to determine the security of the client terminal 200. (S130). The control unit 160 calculates a security index based on security, and the display unit 130 displays the calculated security index (S140).

The controller 160 controls the client terminal 200 to transmit the action to the client terminal 200 through the communication unit 110 based on the security of the client terminal 200 or the calculated security index (S150). . Here, the action is an action defined as supplementing and improving the security or the security index of the client terminal 200, and the action may be stored in the storage 120 in advance as described above. The client terminal 200 performs the action received from the security management device 100 (S160). Thereafter, the above-described steps (S110 to S160) of acquiring an attribute value of the client terminal 200 to determine security, calculating, displaying, and taking measures of a security index may be repeatedly performed.

4 is a diagram illustrating each step of the security management method according to an embodiment. The security management method illustrated in FIG. 4 may be performed by the security management apparatus 100 illustrated in FIG. 2. In addition, in the security management method, at least one or more of the steps shown in FIG. 4 may not be performed, or steps not shown in FIG. 4 may be performed according to an embodiment.

Referring to FIG. 4, receiving an attribute value used to determine the security of the client terminal from the client terminal (S200), and the previously stored attribute criterion as a criterion for determining the security of the client terminal. Comparing with the value (S210), and determining the security of the client terminal based on the result of the comparison (S220) may be performed.

As described above, according to an embodiment of the present invention, when it is necessary to newly generate or change an attribute criterion, which is a criterion, in determining the security of a client terminal, the developer who developed a security management apparatus, that is, in FIG. Administrators can create or change attribute criteria on their own without asking the management server.

In addition, the security management device may receive and store an attribute value used to determine the security of the client terminal from the client terminal. Therefore, when the attribute criteria are newly generated or changed, the security management apparatus may determine the security of the client terminal by comparing the stored attribute values with the generated or changed attribute criteria. That is, the security management device does not need to deliver the generated or changed attribute criteria to the client terminal.

On the other hand, the above-described security management method can be implemented in a readable recording medium of a computer program programmed to perform each step included therein. The aforementioned security management method may also be embodied in a computer program stored in a computer readable recording medium programmed to perform each step included therein.

Here, the computer-readable recording medium includes all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media may include ROM, RAM, CD-ROM, CD-RW, magnetic tape, floppy disk, HDD, optical disk, magneto-optical storage, and the like. It also includes the implementation in the form of (transmission through). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas falling within the scope of the present invention should be construed as being included in the scope of the present invention.

Claims

A communication unit for receiving an attribute value of the client terminal used to determine the security of the client terminal from the client terminal;

A storage unit for storing attribute criteria, which are criteria for determining security of the client terminal;

And a determination unit comparing the attribute criterion with the attribute value and determining the security of the client terminal based on the result of the comparison.

Security management device.
The method of claim 1,

The storage unit,

Stores a list of at least two attribute items that the security management device sends to the client terminal,

The communication unit,

Receiving an attribute value corresponding to each attribute item included in the list of attribute items from the client terminal in response to the list of attribute items being sent to the client terminal;

Security management device.
The method of claim 2,

The security management device,

The apparatus may further include an interface unit configured to receive a list of the property items from an administrator of the security management device.

Security management device.
The method of claim 1,

The attribute criteria,

A method of determining the security of the client terminal by combining a plurality of the attribute values.

Security management device.
The method of claim 4, wherein

Further comprising an interface unit for receiving the attribute criteria from the administrator of the security management device

Security management device.
The method of claim 1,

The storage unit,

Reference identification information for identifying the client terminal in which the agent is installed when there are a plurality of client terminals and an agent is installed in at least one of the client terminals, the attribute value of the client terminal being detected and transmitted to the security management apparatus. Stores a list of

The determination unit,

When a list of acquisition identification information for identifying a client terminal that has sent a packet to the client terminal is received from any one of the plurality of client terminals, the list of the acquisition identification information is compared with the list of the reference identification information. Determining whether the agent is installed in each of the plurality of client terminals based on a result of comparing the list of the acquired identification information with the list of the reference identification information.

Security management device.
The method of claim 6,

The packet,

Address Resolution Protocol (ARP) broadcast packets

Security management device.
The method of claim 1,

The storage unit,

Reference identification information for identifying the client terminal in which the agent is installed when there are a plurality of client terminals and an agent is installed in at least one of the client terminals, the attribute value of the client terminal being detected and transmitted to the security management apparatus. Stores a list of

The determination unit,

When a list of acquisition identification information for identifying the plurality of client terminals is received from a mirroring server that receives TCP / IP packets from the plurality of client terminals, the list of the acquisition identification information is compared with the list of the reference identification information, It is determined whether the agent is installed in each of the plurality of client terminals based on a result of comparing the list of the acquisition identification information with the list of the reference identification information.

Security management device.
The method of claim 1,

The controller may further include a control unit configured to control an action applied to the client terminal to be transmitted to the client terminal according to the determined security of the client terminal.

Security management device.
The method of claim 9,

The above measures,

And a command for limiting the connection of the client terminal to the network or a display unit included in the client terminal to display a message for improving security.

Security management device.
The method of claim 1,

The determination unit,

When there are a plurality of attribute criteria, the security of the client terminal is determined for each of the plurality of attribute criteria,

The security management device,

And a control unit for converting the security of the client terminal determined for each of the plurality of attribute criteria into a number, and calculating the security index of the client terminal by adding the numbers.

Security management device.
The method of claim 11,

Further comprising a display unit for displaying the security index of the client terminal

Security management device.
The method of claim 1,

And a control unit for controlling the process of receiving the attribute value through the communication unit and determining the security of the client terminal by the determination unit according to a predetermined schedule.

Security management device.
The method of claim 1,

The display unit may further include a display unit indicating that modification of the attribute criterion is necessary when the attribute criterion is not determined as the result of the comparison of the attribute criterion with the attribute value.

Security management device.
The method of claim 1,

If the security criterion of the client terminal is not determined as a result of comparing the attribute criterion with the attribute value by the determination unit, request a modification of the attribute criterion to the management server managing the security management apparatus. The controller may further include a controller configured to modify the attribute criteria stored in the storage unit to the received attribute criteria when the attribute criteria are received.

Security management device.
A security management method performed by a security management device,

Receiving an attribute value used to determine the security of the client terminal from the client terminal;

Comparing the stored attribute criterion, which is a criterion for determining the security of the client terminal, with the attribute value;

Determining the security of the client terminal based on the comparison result;

How to manage security.
Receiving an attribute value used to determine the security of the client terminal from the client terminal;

Comparing the stored attribute criterion, which is a criterion for determining the security of the client terminal, with the attribute value;

And determining the security of the client terminal based on the comparison result.

A computer readable recording medium for recording a computer program.
Receiving an attribute value used to determine the security of the client terminal from the client terminal;

Comparing the stored attribute criterion, which is a criterion for determining the security of the client terminal, with the attribute value;

And determining the security of the client terminal based on the comparison result.

A computer program stored on a computer readable recording medium.