WO2023218660A1

WO2023218660A1 - Security risk assessment device, security risk assessment system, security risk assessment method, and program

Info

Publication number: WO2023218660A1
Application number: PCT/JP2022/020265
Authority: WO
Inventors: 諒平佐藤
Original assignee: 日本電信電話株式会社
Priority date: 2022-05-13
Filing date: 2022-05-13
Publication date: 2023-11-16

Abstract

A security risk assessment device comprises a risk identification unit (41) and a risk analysis unit (42). The risk identification unit (41): identifies a security risk inherent in a network system on the basis of security information pertaining to information assets, vulnerabilities, and threats within the network system that are respectively collected by a plurality of security devices; and creates an analysis graph in which the probabilistic dependency relationships of the identified security risks are described in the form of a directed acyclic graph. The risk analysis unit (42) uses the analysis graph and calculates risk probabilities pertaining to node states.

Description

Security risk assessment device, security risk assessment system, security risk assessment method and program

The present invention relates to security risk management and security risk assessment of network systems, and particularly relates to a security risk assessment device, a security risk assessment system, a security risk assessment method, and a program.

In recent years, network systems have been exposed to the threat of various cyber attacks, and security risk management has become increasingly important. Security Risk Assessment, which accurately identifies, quantitatively analyzes and evaluates network system security risks, is essential for correct and efficient security risk management.

Security risk assessment involves collecting and analyzing a huge amount of security information to identify, analyze, and evaluate risks. Security information includes network configuration management information, vulnerability information, intrusion detection system (IDS)/intrusion prevention system (IPS) alarms, etc.

Particularly in large-scale network systems such as enterprise networks, it is not realistic for system operators to manually perform all of these risk assessment tasks in terms of time and workload. Furthermore, because the environment surrounding network systems and the characteristics and magnitude of the risks that network systems face change every day, security risk assessments need not only to be accurate, but also to be performed dynamically and quickly.

Non-Patent Document 1 describes a security risk assessment method using Bayesian Attack Graph (BAG). BAG is a Bayesian Network (BN) for expressing probabilistic dependencies between vulnerabilities inherent in network systems. This is a graph that comprehensively describes the procedure. In BAG, nodes represent system states, and edges represent probabilities of system state transitions. In BAG, a system state is a unique combination of system variables, such as "a state in which administrator authority for a specific information asset (host, etc.) has been handed over to an attacker." The transition of the system state corresponds to "(successful) exploitation of vulnerability." By using BAG, it is possible to mechanically and quantitatively calculate the probability of transition to each system state while considering vulnerability dependencies. Non-Patent Document 2 describes a technique for automatically creating an Attack Graph (AG).

Non-Patent Document 1 does not discuss the method of creating a BAG. In the conventional technology described in Non-Patent Document 1, the collection of security information and risk identification are completely left to humans. In other words, in the conventional technology, it is necessary for a system administrator or the like to manually create a BAG. System administrators and others who create BAGs are required to collect and analyze various security information and accurately identify dependencies between vulnerabilities. Therefore, BAG creators are required to have highly specialized knowledge regarding network systems and vulnerabilities. Additionally, the amount of effort and time required to create a BAG is enormous. In the conventional technology described in Non-Patent Document 2, in order to automatically create an AG, it is necessary to manually prepare a huge amount of input information such as configuration management information and vulnerability dependencies.

Therefore, the present invention aims to solve the above problems and automate risk identification and risk analysis in security risk assessment operations.

The security risk assessment device according to the present invention identifies security risks inherent in the network system based on security information regarding information assets, vulnerabilities, and threats in the network system collected by a plurality of security devices. a risk identification unit that creates an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of an acyclic directed graph; and a risk analysis unit that uses the analysis graph to calculate risk probabilities regarding node states. It is characterized by comprising the following.

According to the present invention, risk identification and risk analysis in security risk assessment work can be automated.

1 is a schematic configuration diagram of a system including a security risk assessment device according to a first embodiment of the present invention. FIG. 2 is a schematic diagram showing probabilistic dependencies of information assets, vulnerabilities, threats, and various security information in a network system. FIG. 2 is a schematic diagram of an analysis graph created by the security risk assessment device. 3 is a flowchart showing the flow of processing for creating an analysis graph. 5 is a flowchart showing the flow of step S1 in FIG. 4. FIG. FIG. 5 is a schematic diagram showing the correspondence between step S1 in FIG. 4 and an analysis graph. FIG. 5 is a schematic diagram showing the correspondence between step S2 in FIG. 4 and an analysis graph. 5 is a schematic diagram showing an example of calculation performed in step S2 in FIG. 4. FIG. FIG. 5 is a schematic diagram showing the correspondence between step S3 in FIG. 4 and an analysis graph. FIG. 5 is a schematic diagram showing the correspondence between step S4 in FIG. 4 and an analysis graph. 5 is a schematic diagram showing an example of calculation performed in step S4 in FIG. 4. FIG. 12 is a flowchart showing the flow of processing for calculating risk probabilities regarding node states using an analysis graph. FIG. 2 is a schematic configuration diagram of a system including a security risk assessment device according to a second embodiment of the present invention. 1 is a hardware configuration diagram showing an example of a security risk assessment device according to each embodiment of the present invention and a computer that implements the functions of each device.

Hereinafter, the security risk assessment device according to the present embodiment will be described in detail with reference to the drawings.
[System configuration overview]
As shown in FIG. 1, the security risk assessment system 1 includes an information acquisition section 10, a data processing section 20, a database 30, a risk assessment section (security risk assessment device) 40, and an assessment result output section 50. We are prepared. The information acquisition unit 10 automatically collects security information regarding information assets, vulnerabilities, and threats in a network system, which are collected by a plurality of security devices. The data processing unit 20 processes the security information acquired by the information acquisition unit 10 to format it according to predetermined requirements, and stores in the database 30 data associated with the time at which the security information was collected. The risk assessment unit 40 performs risk assessment based on data stored in the database 30. The assessment result output unit 50 presents the results of the risk assessment to the system administrator 2 and the like.

[Premise]
The premise of this embodiment will be explained with reference to FIG. FIG. 2 is a schematic diagram showing the probabilistic dependencies of information assets, vulnerabilities, threats, and various security information in a network system. In this embodiment, information assets in a network system are expressed as a tuple of "host" and "application or protocol." Therefore, it is assumed that an ID that can uniquely identify each of them is given in advance. In the following, an IP address and a port number are used as IDs, but in reality, any ID may be used.

For example, an IP address is used as an ID to identify a host, and a TCP/UDP port number is used as an ID to identify an application or protocol. For example, an information asset is expressed as (196.216.0.1, TCP3306 (MySQL (registered trademark))). This example tuple indicates an application (DB, etc.) that uses MySQL (registered trademark) on the host having the IP address.

Vulnerabilities within a network system are uniquely identified using a "vulnerability ID." Here, the CVE identification number (CVE-ID) of Common Vulnerabilities and Exposures is used as the vulnerability ID. As threats to network systems, we assume external attacks on information assets and unauthorized communications. Here, the threat information is the "average number of alerts per unit time" for each information asset. The probabilistic dependencies of the various security information mentioned above are calculated mainly based on network flow (communication amount).
The details of each part of the security risk assessment system 1 will be described below.

[Information acquisition unit 10]
The information acquisition unit 10 includes a network flow information acquisition unit 11, a vulnerability information acquisition unit 12, and a threat information acquisition unit 13, as shown in FIG. The network flow information acquisition unit 11 acquires security information regarding information assets. The vulnerability information acquisition unit 12 acquires security information regarding vulnerability. The threat information acquisition unit 13 acquires security information regarding threats.

As for the information acquisition unit 10, commercially available products can be used. A network flow collector (for example, NetFlow) installed within the network can be applied to the network flow information acquisition unit 11. A network flow collector can obtain statistical information on packets flowing through a router. A vulnerability detection tool (for example, Vuls) installed within the network can be applied to the vulnerability information acquisition unit 12. As the threat information acquisition unit 13, an IDS/IPS (for example, Suricata) installed within the network can be applied. Suricata can identify attacks by combining IDS and IPS. The information obtained from various security products of the information acquisition unit 10 includes logs, alerts, detection results, and the like.

[Data processing unit 20, database 30]
The data processing unit 20 aggregates information obtained from various security products of the information acquisition unit 10, organizes and formats the information into a format that satisfies the following requirements, and stores the information in the database 30. The database 30 stores information shown in the table below.

In this specification, a tuple of a host and a source port is referred to as a "source interface." Furthermore, a tuple of a host and a destination port is called a "destination interface." Note that for convenience, data is also expressed in symbols here. Let h be the host, s be the start port, and d be the end port. The starting point interface is expressed as i=(h,s). The end point interface is expressed as j=(h,d). Let v be the vulnerability, and express the vulnerability v inherent in host h as the vulnerability node u=(h,v).

As will be described later, the database 30 receives a specific period as a query from the risk identification unit 41, and stores the data flow related to each interface during that period, the unit time average of the number of malicious communications, and the internal information of each host during that period. The vulnerability information that was previously used is provided to the risk identification unit 41, respectively. Therefore, to meet this requirement, these data are stored with time information. It is assumed that such processing is performed in advance by the data processing unit 20, and that the database 30 also satisfies this requirement.

[Risk Assessment Department 40]
Based on the information in the database 30, the risk assessment unit 40 calculates the "probability that unauthorized communication reaches each asset (interface) in a certain period" and the "probability that each vulnerability is exploited in a certain period." calculate. For this purpose, the risk assessment unit 40 uses a directed acyclic graph as shown in FIG. Hereinafter, such a directed acyclic graph will be referred to as an analytic graph.

In the analysis graph, the starting point interface (Src Interface) in the network system, the ending point interface (Dst Interface), and the vulnerability inherent in each host are described as nodes in the analysis graph. The analysis graph expresses the probability that unauthorized communication from the outside will propagate between interfaces, the probability that it will lead to a vulnerability attack, etc. as edges and their weights.

Each node has its own state variables. If the node is an interface node, the unique state variable is a binary variable that indicates whether (1) an unauthorized communication has arrived or not (0). If the node is a vulnerable node, the unique state variable is a binary variable that indicates whether it has been exploited (1) or not (0). The risk assessment unit 40 determines the probability that unauthorized communication from the outside will propagate between interfaces by determining the probability that each of these state variables becomes 1 (that is, the expected value of each state variable) based on graph theory. and the probability that it will lead to a vulnerability attack.

Note that the BN nodes in the prior art described in Non-Patent Document 1 represent system states (unique combinations of system variables), so when applying that prior art to a large-scale network, the system variables are There is a problem in that it causes an explosion and makes it difficult to create a BN in terms of computational cost. On the other hand, the BN nodes created by the risk assessment unit 40 represent ports or vulnerabilities in the host, so the graph is less likely to become enlarged and can be applied to large-scale networks.

As shown in FIG. 1, the risk assessment section 40 includes a risk identification section 41 and a risk analysis section 42. The risk identification unit 41 identifies security risks inherent in the network system based on the security information, and creates an analytical graph that describes the probabilistic dependencies of the identified security risks in the form of an acyclic directed graph. . The risk analysis unit 42 calculates the risk probability regarding the state of the node using the analysis graph.
The details of each part of the risk assessment section 40 will be explained below.

[Risk identification department 41]
Based on the information obtained from the information acquisition unit 10 during a certain period, the risk identification unit 41 identifies risks inherent in the network system during the period, and describes the probabilistic dependencies thereof as an analysis graph. do. For this purpose, a system administrator or the like specifies an arbitrary period t in the past. The period t may be, for example, a period from 5 minutes ago to the present. The risk identification unit 41 sequentially executes the following processes. The risk identification unit 41 inputs the period t into the database 30 as a query and acquires various information for the period. The risk identification unit 41 receives information obtained from the database 30 and creates an analysis graph for use in risk analysis. The risk identification unit 41 inputs the created analysis graph to the risk analysis unit 42.

Next, the flow of processing in which the risk identification unit 41 creates an analysis graph will be described with reference to FIG. 4 (see FIG. 3 as appropriate).
The risk identifying unit 41 identifies dependencies between hosts in a predetermined period t (step S1). Here, the risk identification unit 41 describes dependencies between hosts based on data flow and alert information. Then, the risk identification unit 41 identifies inter-interface dependencies between the host groups (step S2). Here, the risk identification unit 41 calculates and describes the dependency relationship between ports (interfaces), that is, the probability that unauthorized communication will flow between the interfaces, according to the dependency relationship between hosts identified in step S1.

Then, the risk identifying unit 41 identifies the dependency relationship between the end point interface and the vulnerability in each host (step S3). Here, the risk identification unit 41 calculates and describes the probability that a vulnerability will be accessed from the endpoint port (endpoint interface) and exploited.
Then, the risk identifying unit 41 identifies the dependency relationship between the vulnerability and the starting point interface in each host (step S4). Here, the risk identification unit 41 calculates and describes the probability that unauthorized communication will be performed from the source port (source interface) after the vulnerability is exploited.
The risk identification unit 41 then sets the state variable of each node in each host based on the alert information (step S5).

Hereinafter, details of steps S1 to S5 will be explained in detail with reference to drawings and formulas.
(Step S1)
In step S1, the risk identification unit 41 obtains the inter-host dependency relationships L ₀ , L ₁ , L ₂ ,...L _l during the period t. Here, L _l is a set of hosts whose “distance” from the Internet (external) is l. A list in which hosts whose distance from the outside is l is enumerated is called a list L _l . List L ₀ enumerates hosts that have directly received unauthorized communications from the outside. List _L1 contains hosts that have received direct communication from hosts belonging to the immediately preceding list _L0 . Similarly, for list _L2 and subsequent lists, hosts that have received direct communication from hosts belonging to the immediately preceding list are entered.
Note that the value of l is automatically determined according to the input information (network environment). Furthermore, if the host that communicated does not exist in the first place, these dependencies cannot be obtained, so a graph cannot be created and an assessment cannot be performed.

Next, a detailed process flow regarding step S1 will be described with reference to FIGS. 5 and 6. Note that FIG. 6 is a schematic diagram showing the correspondence between the inter-host dependencies L ₀ , L ₁ , L ₂ ,….L _l and the analysis graph when the analysis graph creation process by the risk identification unit 41 is completed. It is a diagram.
In order to create this analysis graph, the risk identification unit 41 first enumerates hosts that communicated (alerts, network flows) during the period t in a list _LA (step S11). This list L _A initially lists all hosts for which an alert has been generated due to communication from the outside within the period t, or all hosts that have communicated with other hosts within the network system. Then, during the following process, the risk identification unit 41 performs an update to sequentially delete hosts from the list _LA according to the dependency relationship between the hosts.

Next, the risk identification unit 41 enumerates, in the list _L0 , hosts that have received malicious communications (alerts) from the outside during the period t from the list LA (step _S12 ). In the list _L0 , as shown in FIG. 6, all hosts that have received an alert are listed in close proximity to the outside (Internet). The risk identification unit 41 then determines whether the list L ₀ is empty (step S13). If the list L ₀ is not empty (step S13: No), the risk identification unit 41 deletes the host in the list L ₀ from the list _LA (step S14), and updates the list _LA . The risk identification unit 41 continues updating the list _LA until the list _LA becomes empty, as described below. First, the risk identification unit 41 determines whether the list _LA is empty (step S15). If the list L _A is not empty (step S15: No), the risk identification unit 41 sets the value of distance l from the Internet (external) to 0 (l ← 0: step S16), and repeats the following process. .

In the iterative process, first, the risk identification unit 41 selects the hosts included in the list L _A from among the hosts that directly received communication (network flow) from each host in the list L _l during the period t into a list L _l+1. (Step S21). Note that when the value of the distance l is 0 in step S21, the list L _l+1 becomes L ₁ . At this time, as shown in FIG. ₆ , in the list L1, all hosts that have directly received communication (network flow) from each host in the list _L0 are listed in proximity to the list _L0 .

Following step S21, the risk identification unit 41 determines whether the list L _l+1 is empty (step S22). If the list L _l+1 is not empty (step S22: No), the risk identification unit 41 deletes the host in the list L _l+1 from the list _LA (step S23) and updates the list _LA . Subsequently, the risk identification unit 41 determines whether the list _LA is empty (step S24). If the list _LA is not empty (step S24: No), the risk identification unit 41 increments the value of l (l←l+1: step S25), and returns to step S21.
Note that when the value of the distance l is 1 in step S21, the list L _l+1 becomes L ₂ . At this time, as shown in FIG. 6, in list _L2 , all hosts that have directly received communication (network flow) from each host in list _L1 are listed in proximity to list _L1 .
Similarly, in step S21, list L _l includes all hosts that have directly received communication (network flow) from each host in list L _1-1 that are close to list L _1-1 , as shown in FIG. are listed.

On the other hand, if the list L _A is empty in step S24 (step S24: Yes), the risk identification unit 41 increments the value of l (l ← l+1: step S26), and The relationships L ₀ , L ₁ , L ₂ ,...L _l are obtained (step S27), and the process ends. Note that if the list L _l+1 is empty in step S22 (step S22: Yes), the risk identification unit 41 proceeds to step S27.
Furthermore, if the list _LA is empty in step S15 (step S15: Yes), the risk identification unit 41 obtains L ₀ as the inter-host dependency relationship at the time (step S28), and ends the process.
Further, if the list L ₀ is empty in step S13 (step S13: Yes), the risk identification unit 41 ends the process.

(Step S2)
In step S2, the risk identification unit 41 calculates the conditional probability that malicious communication will occur between each start point interface node and end point interface node, and creates an edge using the calculated value as a weight. An edge is defined between a host group (L _n ) and a host group (L _n+1 ) that are adjacent to each other. Here, in the case where the malicious communication reaches the starting point interface node i=(h _i ,s), h _i ∈L _n , the starting point interface node i=(h _i ,s), h _i ∈L _n , Let p _ij be the conditional probability that malicious communication occurs between the end point interface node j=(h _j ,d), h _j ∈L _n+1 . This probability p _ij is expressed as the weight of the edge between node i and node j.

FIG. 7A is a schematic diagram showing the correspondence between step S2 and the analysis graph. In the analysis graph shown in FIG. 7A, for example, an area 201 surrounded by a virtual line indicates communication occurring between a starting point interface node of a host belonging to host group L ₀ and a destination point interface node of a host belonging to host group L ₁ . Shown schematically. Further, for example, an area 202 surrounded by a virtual line schematically shows communication occurring between a starting point interface node of a host belonging to host group L ₁ and a destination point interface node of a host belonging to host group L ₂ . .

In step S2, the risk identification unit 41 normalizes the ratio of network flows to a probability p _ij . The risk identification unit 41 calculates the probability p _ij using, for example, the following equation (1).

In equation (1), μ _ij is the network flow between the source interface node i and the destination interface node j. Further, ρ _i is the total amount of network flows sent out from the starting point interface node i.

Next, a specific example of the probability p _ij calculated by the risk identification unit 41 will be described with reference to FIG. 7B. For example, as shown in FIG. 7B, if the network flows (communication volumes) from the source interface node i to the destination interface nodes j ₁ , j ₂ , and j ₃ are 2, 5, and 4, respectively, the amount of data sent from the source interface node i is The total amount of network flows ρ _i is 11. Therefore, according to equation (1), the probabilities that communication will occur from the starting point interface node i to the ending point interface nodes j ₁ , j ₂ , and j ₃ are 2/11, 5/11, and 4/11, respectively.

Note that the system administrator may give an arbitrary probability value as the probability p _ij . Also, the system administrator may provide another method for calculating the probability p _ij .

(Step S3)
In step S3, the risk identification unit 41 calculates "the probability that each vulnerable node will be exploited after each endpoint interface node accesses each vulnerable node" and creates an edge with that value as a weight. do. Edges are defined between endpoint interface (port) nodes and vulnerable nodes within the same host. Here, if malicious communication reaches end point interface node j=(h,d), vulnerable node u=(h,v) is accessed from end point interface node j=(h,d). Let q _ju be the conditional probability, and let w _u be the conditional probability that vulnerable node u will be further exploited. Also, let the weight of the edge between the end point interface node j and the vulnerability node u be q _ju ×w _u .

FIG. 8 is a schematic diagram showing the correspondence between step S3 and the analysis graph. In the analysis graph shown in FIG. 8, for example, an area 301 surrounded by a virtual line schematically shows access from an end point interface node to a vulnerable node in a host belonging to host group _L0 . An area 302 surrounded by a virtual line schematically shows access from the end point interface node to the vulnerable node within the hosts belonging to the host group _L1 . An area 303 surrounded by a virtual line schematically shows access from the end point interface node to the vulnerable node within the hosts belonging to the host group _L2 . An area 304 surrounded by a virtual line schematically shows access from the end point interface node to the vulnerable node within the host belonging to the host group L _l .

The probability q _ju is defined as a binary value of 0 or 1, for example. For example, it can be defined as 1 if application a with vulnerability v uses d as the end port, and 0 otherwise. Further, the probability w _u can be calculated using, for example, a calculation method based on the Common Vulnerability Scoring System (CVSS). Note that a calculation method based on CVSS is described in Non-Patent Document 1.

Note that the system administrator may give arbitrary probability values as the probability q _ju and the probability w _u . Further, the system administrator may provide another calculation method for the probability q _ju and the probability w _u .

(Step S4)
In step S4, the risk identification unit 41 calculates "the probability that unauthorized communication will be performed from each start point interface node after each vulnerable node is exploited" and creates an edge using the calculated value as a weight. An edge is defined between a vulnerable node and a source interface (port) node within the same host. Here, if the vulnerable node u=(h,v) is exploited, the probability that the starting point interface node i=(h,s) is accessed from the vulnerable node u=(h,v) is expressed as r _ui far. This probability r _ui is expressed as the weight of the edge between node u and node i.

FIG. 9A is a schematic diagram showing the correspondence between step S4 and the analysis graph. In the analysis graph shown in FIG. 9A, for example, an area 401 surrounded by a virtual line schematically shows access from a vulnerable node to a starting point interface node in a host belonging to host group _L0 . An area 402 surrounded by a virtual line schematically shows access from a vulnerable node to a starting point interface node within a host belonging to host group _L1 . An area 403 surrounded by a virtual line schematically shows access from a vulnerable node to a starting point interface node in a host belonging to host group _L2 .

Regarding the probability r _ui calculated by the risk identification unit 41, for example, assuming that the starting point ports used by the host are random, the ratio of network flows sent out from each starting point interface node is expressed as the probability r _ui . can be defined. In this case, the risk identification unit 41 calculates the probability r _ui using the following equation (2). In equation (2), ρ _i is the total amount of network flows sent out from the source interface node i.

Next, a specific example of the probability r _ui calculated by the risk identification unit 41 will be described with reference to FIG. 9B. FIG. 9B is a schematic diagram showing the following conditions 1 to 4.
(Condition 1) Network flows are sent out from each of the start point interface nodes i ₁ , i ₂ , and i ₄ , and other start point interface nodes including i ₃ do not send out network flows.
(Condition 2) The total amount of network flows sent out from the starting point interface node _i1 is 6.
(Condition 3) The total amount of network flows sent out from the starting point interface node _i2 is 8.
(Condition 4) The total amount of network flows sent out from the starting point interface node _i4 is 15.
In this case, the total number of network flows sent out from all source interface nodes within the host is 29. Therefore, according to equation (2), the probabilities that the starting point interface nodes i ₁ , i ₂ , and i ₄ are accessed from the vulnerable node u are 6/29, 8/29, and 15/29, respectively.

Note that the system administrator may give an arbitrary probability value as the probability r _ui . Additionally, the system administrator may provide another method for calculating the probability r _ui .

(Step S5)
In step S5, the risk identification unit 41 defines and sets state variables of each start point interface node, end point interface node, and vulnerability node.
The risk identification unit 41 defines a state variable M _i representing whether or not unauthorized communication has arrived at the starting point interface node i. The state variable M _i is a binary variable, and is 1 if an unauthorized communication has arrived, and 0 otherwise. Let the initial value of the state variable M _i be 0.
The risk identification unit 41 defines a state variable M _j that indicates whether or not unauthorized communication has arrived at the end point interface node j . The state variable M _j is a binary variable, and is 1 if an unauthorized communication has arrived, and 0 otherwise. Let the initial value of the state variable M _j be 0.
The risk identification unit 41 defines a state variable E _u representing whether or not the vulnerability node u has been exploited. The state variable E _u is a binary variable; it is 1 if it has been exploited and 0 otherwise. Let the initial value of the state variable E _u be 0.

In step S5, the risk identification unit 41 sets the state variable M _j of the end point interface node that directly received the unauthorized communication from the outside to 1 for the host group belonging to the list L ₀ . That is, the risk identification unit 41 sets the state variable M _j using, for example, the following equation (3). In equation (3), λ _j is the unit time average of the number of fraudulent communications (occurred IDS/IPS alerts) received by the end point interface j.

Note that the system administrator may provide another setting method for this state variable _Mj .
The processing of the risk identification unit 41 is now complete, and the created analysis graph is sent to the risk analysis unit 42.

[Risk analysis department 42]
The risk analysis unit 42 sequentially executes the following processes. The risk analysis unit 42 acquires the analysis graph from the risk identification unit 41. The risk analysis unit 42 calculates risk probabilities regarding node states. The risk analysis unit 42 inputs the obtained risk probability of each node to the assessment result output unit 50.

Next, the flow of processing in which the risk analysis unit 42 calculates the risk probability will be described with reference to FIG. 10 (see FIGS. 1 and 6 as appropriate). FIG. 10 is a flowchart showing the flow of processing for calculating risk probabilities. Note that the state variable calculation and update method will be described later.
First, the risk analysis unit 42 sets the value of the identifier n of the list L _n that specifies dependencies between hosts to 0 (n ← 0: step S31). Then, the risk analysis unit 42 calculates the probability that the state variable of each end point interface node becomes 1 (expected value of the state variable) for all hosts in the list L _n , and substitutes it as the value of the new state variable. Update (step S32). However, when n=0 (that is, for the host group belonging to list _L0 ), the state variable of the end point interface node has already been set in the risk identification unit 41, so step S32 is omitted. Then, the risk analysis unit 42 calculates the probability that the state variable of each vulnerable node becomes 1 (expected value of the state variable) for all hosts in the list L _n , and substitutes it as the value of the new state variable. Update (step S33). Then, the risk analysis unit 42 determines whether n=l (step S34). If n=l is not true (step S34: No), the risk analysis unit 42 calculates the probability that the state variable of each start point interface node becomes 1 (expected value of the state variable) for all hosts in the list L _n . and is substituted and updated as a new state variable value (step S35). Subsequently, the risk analysis unit 42 increments the value of n (n←n+1: step S36), and returns to step S32. On the other hand, in step S33, if n=l (step S34: Yes), the risk analysis unit 42 ends the process of calculating the risk probability.

The risk analysis unit 42 calculates and updates the value (expected value) of the state variable of each node sequentially from the top to the bottom along the edge direction. Here, the risk analysis unit 42 calculates the weight of each edge by regarding it as a conditional probability regarding the state variable. In other words, the risk analysis unit 42 performs calculations assuming that the analysis graph is a BN.

The details of step S32, step S33, and step S35 will be explained below.
(Step S32)
In step S32, the risk analysis unit 42 calculates the weight of the edge extending from the source interface node to the destination interface node as "the probability that the unauthorized communication will reach the destination interface node if the unauthorized communication reaches the source interface node." Perform calculations assuming that. When the risk analysis unit 42 regards the analysis graph as a BN and calculates the probability that the state variable of the end point interface node becomes 1, this becomes the risk probability as it is. The risk probability in this case is the probability that fraudulent communication has reached the end point interface node.

(Step S33)
In step S33, the risk analysis unit 42 considers the weight of the edge extending from the end point interface node to the vulnerable node as "the probability that the vulnerable node will be exploited when fraudulent communication reaches the end point interface node." Perform calculations. When the risk analysis unit 42 regards the analysis graph as a BN and calculates the probability that the state variable of the vulnerable node becomes 1, this becomes the risk probability. The risk probability in this case is the probability that a vulnerable node is being exploited.

(Step S35)
In step S35, the risk analysis unit 42 regards the weight of the edge extending from the vulnerable node to the starting point interface node as "the probability that unauthorized communication will occur from the starting point interface node if the vulnerable node is exploited." Do the calculations. When the risk analysis unit 42 regards the analysis graph as a BN and calculates the probability that the state variable of the starting point interface node becomes 1, this becomes the risk probability as it is. The risk probability in this case is the probability that fraudulent communication has reached the starting point interface node. The risk analysis unit 42 may apply a BN calculation method using a Conditional Probability Table (CPT).

In steps S32, S33, and S35, the calculation method by which the risk analysis unit 42 obtains each risk probability is not limited to the BN calculation method using CPT.
The risk analysis unit 42 can also obtain the risk probability by calculating the expected value of the state variable of the end point interface node using the following equation (4).
The risk analysis unit 42 can also obtain the risk probability by calculating the expected value of the state variable of the vulnerable node using the following equation (5).
The risk analysis unit 42 can also obtain the risk probability by calculating the expected value of the state variable of the starting point interface node using the following equation (6).

Here, if an edge with a non-zero weight extends from node A to node B, node A is called the parent node of node B. In equation (4), P _j is a set of parent nodes of the end point interface node j. In equation (5), P _u is a set of parent nodes of the vulnerable node u. In equation (6), P _i is a set of parent nodes of the starting point interface node i. A calculation method that considers only expected values in this way is likely to be able to process faster than a BN calculation method that uses CPT.

The processing of the risk analysis unit 42 is now complete, and the calculated risk probability is sent to the assessment result output unit 50.

The risk assessment unit 40 can perform an objective risk assessment that takes into consideration specific threats. For comparison, for example, in the conventional technology described in Non-Patent Document 2, only the "probability that the network system will be attacked" is considered as a threat parameter, and in addition, the "probability that the network system will be attacked" is considered. It was necessary to arbitrarily set it manually. On the other hand, the risk assessment unit 40 considers actual threat information. In other words, the risk assessment unit 40 determines the endpoint interface that directly received unauthorized communications from the outside based on the unit time average λ _j of the number of unauthorized communications (occurred IDS/IPS alerts), as shown in equation (3) above. A node state variable M _j is set and used to calculate the risk probability. Therefore, the risk assessment unit 40 can perform a more objective analysis than the conventional technology described in Non-Patent Document 2. Moreover, by suppressing the increase in the size of the analysis graph, scalability can be improved compared to the case of using the BAG of Non-Patent Document 2.

[Assessment result output unit 50]
The assessment result output unit 50 provides various risk probabilities (ie, assessment results) received from the risk assessment unit 40 to the system administrator 2 and the like.
The assessment result output unit 50 may provide the results to a system administrator or the like after processing the data, such as determining a risk probability threshold or sorting. This allows system administrators and the like to obtain assessment results that are easier to understand.
By referring to the risk probabilities, system administrators and the like can take risk countermeasures, such as patching vulnerabilities with higher risk probabilities preferentially. Furthermore, by referring to the risk probability, system administrators and the like can take risk countermeasures, such as preferentially analyzing IDS/IPS alerts related to ports with higher risk probability.

As explained above, the risk assessment unit 40 according to the first embodiment can automate and mechanize risk identification and risk analysis in security risk assessment work. Such automation and mechanization not only reduce human operation (human work time and workload), but also contribute to speeding up assessments. Furthermore, the security risk assessment system 1 according to the first embodiment can automate everything from information collection to risk identification and risk analysis. Automation also makes it easier for system administrators without advanced expertise to conduct risk assessments, minimizing the possibility of human error.

(Second embodiment)
Next, with reference to FIG. 11, a security risk assessment system 1B according to a second embodiment will be described. Note that the same components as the security risk assessment system 1 shown in FIG. 1 are denoted by the same reference numerals, and the description thereof will be omitted. The security risk assessment system 1B is different from the security risk assessment system 1 in that it includes an asset value information input section 60 and also includes a risk evaluation section 43 in the risk assessment section 40B.

[Asset value information input section 60]
The asset value information input section 60 is a function for inputting asset values and risk criteria. Asset value is the value of information assets in a network system. The asset value may be, for example, the cost of loss when a risk materializes. The information input from the asset value information input section 60 is stored in the database 30 like other various security information. Information input from the asset value information input section 60 is transmitted from the database 30 to the risk evaluation section 43.

[Risk assessment department 43]
The risk evaluation unit 43 is a function that performs risk evaluation using the various risk probabilities calculated by the risk analysis unit 42 and the input asset value and risk criteria. For example, a system administrator or the like inputs the asset value and risk standard of each information asset.

An asset value is assigned to each end point interface node. Alternatively, the asset value is assigned to each starting point interface node. Alternatively, an asset value is assigned to each vulnerable node. As an example, a case will be explained in which an asset value is given to an end point interface node.
For example, a system administrator or the like may give asset values in real numbers to all end point interface nodes on the analysis graph. Alternatively, a system administrator or the like may give asset values in real numbers to some end point interface nodes that are considered to be particularly important on the analysis graph.

For example, assume that an information asset that satisfies the following conditions 1 to 3 exists in the target network system.
(Condition 1) Important company management information is stored in an application (database, etc.) on host h.
(Condition 2) The application can be accessed from end port d on host h.
(Condition 3) The estimated loss cost if important management information of the company is lost or leaked is 50 million yen.
In this case, the system administrator or the like inputs "50 million yen" as the asset value of the corresponding end point interface node (h, d) of the analysis graph using the asset value information input unit 60.
Note that the input asset value is not limited to the monetary amount, and may be, for example, the human working time (man-months) required for risk treatment. In addition, the input asset values can be divided into concepts such as "large,""medium," and "small" by arbitrarily setting thresholds for each range such as "large,""medium," and "small." There may be.

The risk criterion is the acceptable cost of loss. The risk criterion may be, for example, an upper bound on the expected value of tolerable loss costs. For example, the system administrator or the like may input "1 million yen" as the risk standard using the asset value information input unit 60.

Note that the information input to the asset value information input section 60 does not necessarily need to be stored in the database 30. For example, a system administrator or the like may directly input asset values and risk standards into the risk evaluation section 43.

The risk evaluation unit 43 calculates the estimated loss cost using the asset value information input by the system administrator etc. and the risk probability calculated by the risk analysis unit 42, and compares the estimated loss cost with the risk standard. determine the acceptability of the risk.

As an example, a case will be explained in which an asset value is given to the end point interface node. The risk evaluation unit 43 calculates the expected value of loss cost for all end point interface nodes from their risk probabilities and asset values. At this time, for nodes for which asset values have not been input, default values may be determined in advance according to some kind of policy. Note that the risk evaluation unit 43 saves the calculated information in the database 30 or the like so that it can be referenced by a system administrator or the like. Therefore, even if the risk is deemed to be acceptable, the system administrator or the like can refer to the information on the estimated loss cost calculated by the risk evaluation unit 43.

The risk evaluation unit 43 can determine the acceptability of the risk by comparing the calculated estimated loss cost with the risk standard. The risk evaluation unit 43 uses the risk standard as a threshold to determine whether the estimated loss cost is smaller than the risk standard (threshold), and if it is smaller, determines that the risk is acceptable.
As an example, assume that a system administrator or the like inputs "1 million yen" as the risk standard using the asset value information input unit 60. In this case, the risk evaluation unit 43 determines that the risk is "acceptable" when the estimated loss cost is less than 1 million yen. In this way, when the risk evaluation unit 43 determines that the risk is acceptable, there is no need to notify the system administrator or the like of the determination result.
On the other hand, when the estimated loss cost exceeds 1 million yen, the risk evaluation unit 43 notifies the system administrator etc. of the specific estimated loss cost. In this case, it is preferable that the risk evaluation unit 43 also notify the system administrator, etc. of the location and risk probability of the interface node (or vulnerable node) that is considered to be particularly important.

As explained above, the risk assessment unit 40B according to the second embodiment can automate and mechanize risk identification, risk analysis, and risk evaluation in security risk assessment work. Furthermore, the security risk assessment system 1B according to the second embodiment can automate everything from information collection to risk identification, risk analysis, and risk evaluation.

(Third embodiment)
Next, a security risk assessment system according to a third embodiment will be described with reference to FIGS. 1 and 11. The third embodiment differs from the first and second embodiments in that the function of the risk identification section 41 in the

risk assessment sections

40 and 40B is expanded.
The risk identification unit 41 according to the first and second embodiments always inputs 0 or 1 when setting the state variable of each node of the analysis graph.
On the other hand, the risk identification unit 41 according to the third embodiment inputs a probability value (an arbitrary value within the closed interval [0,1]) to each node of the analysis graph in advance. Two specific examples will be described below.

[First specific example]
As a first specific example, the risk identification unit 41 inputs in advance the IDS/IPS false negative probability to all end point interface nodes that have not received fraudulent communication in the analysis graph. Here, the false negative probability of IDS/IPS is the probability of overlooking fraudulent communications that should have raised an alert. Specifically, the risk identification unit 41 sets the initial value of the state variable M _j of all end point interface nodes j that have not received unauthorized communication (no alert has occurred) in the created analysis graph to 0 instead of 0. Let it be the false negative probability.

Note that when the risk identification unit 41 inputs the false negative probability, the risk analysis unit 42 at the subsequent stage of the risk identification unit 41 determines that the actually calculated risk probability and the false negative probability set as the initial value exist at the same time. I will do it. Here, the risk probability is the probability that the node's state variable becomes 1 or the expected value of the state variable. Then, there is a possibility that the risk probability and the false negative probability, which exist simultaneously in the risk analysis section 42, conflict with each other. In such a case, the risk analysis unit 42 may determine the risk probability by comparing the two and taking the maximum value.

[Second specific example]
As a second specific example, the risk identification unit 41 inputs the probability of receiving fraudulent communication during a predetermined period in the future for each end point interface node of the analysis graph.
In the first and second embodiments, the risk probability in the past predetermined period t is calculated based on the track record of actually receiving fraudulent communications in the past predetermined period t.
In contrast, in this specific example of the third embodiment, the risk probability for a predetermined period in the future is determined based on past performance.

Specifically, the risk identification unit 41 calculates the probability that each endpoint interface node will receive fraudulent communication during a predetermined period in the future based on the past record of receiving fraudulent communications, and calculates the probability value for each endpoint interface node to receive fraudulent communications in the corresponding endpoint interface. Set the initial value of the node's state variable. Thereby, the risk analysis unit 42 subsequent to the risk identification unit 41 calculates the risk probability for a predetermined period in the future. However, if there is a conflict between the actually calculated risk probability and the probability value set as the initial value, the risk analysis section 42 will determine the risk probability by comparing them and taking the maximum value. Just let it happen. Note that when setting a value other than 0,1 to the state variable, the risk analysis unit 42 cannot perform calculations using CPT, and therefore uses a calculation method using expected values.

According to the third embodiment, the accuracy of risk assessment can be further improved than in the first and second embodiments.

[Hardware configuration]
The risk assessment units (security risk assessment devices) 40, 40B according to each of the embodiments described above are realized by, for example, a computer 900 configured as shown in FIG. 12.
FIG. 12 is a hardware configuration diagram showing an example of a computer 900 that implements the functions of the

risk assessment sections

40 and 40B according to this embodiment. The computer 900 includes a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, an HDD (Hard Disk Drive) 904, an input/output I/F (Interface) 905, and a communication I/F 906. and a media I/F 907.

The CPU 901 operates based on a program stored in the ROM 902 or HDD 904. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started, programs related to the hardware of the computer 900, and the like.

The CPU 901 controls an input device 910 such as a mouse and a keyboard, and an output device 911 such as a display and a printer via an input/output I/F 905. The CPU 901 obtains data from the input device 910 via the input/output I/F 905 and outputs the generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used in addition to the CPU 901 as the processor.

The HDD 904 stores programs executed by the CPU 901 and data used by the programs. Communication I/F 906 receives data from other devices via communication network 920 and outputs it to CPU 901 , and also transmits data generated by CPU 901 to other devices via communication network 920 .

The media I/F 907 reads the program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to target processing from the recording medium 912 onto the RAM 903 via the media I/F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable disk), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a semiconductor memory, or the like.

For example, when the computer 900 functions as the

risk assessment units

40 and 40B according to each of the embodiments, the CPU 901 executes the program loaded onto the RAM 903 to realize the functions of the

risk assessment units

40 and 40B. Furthermore, the data in the RAM 903 is stored in the HDD 904 . The CPU 901 reads a program related to target processing from the recording medium 912 and executes it. In addition, the CPU 901 may read a program related to target processing from another device via the communication network 920.

[effect]
As explained above, the security risk assessment device evaluates the security risks inherent in the network system based on security information about information assets, vulnerabilities, and threats in the network system collected by multiple security devices. a risk identification unit 41 that creates an analysis graph that describes the probabilistic dependencies of the identified security risks in the form of an acyclic directed graph; and a risk analysis unit that uses the analysis graph to calculate risk probabilities regarding node states. It is characterized by comprising a section 42.

By doing so, in the security risk assessment device, the risk identification unit 41 can calculate the probability that fraudulent communication has reached each information asset in the network system based on the security information. Further, the risk identification unit 41 can calculate the probability that each vulnerability in the network system is exploited based on the security information. Therefore, a system administrator or the like can refer to the risk probability calculated by the security risk assessment device without manually creating a BN. In addition, the security risk assessment device automates risk identification and analysis, making it easier for system administrators without advanced specialized knowledge to conduct risk assessments and minimizing the possibility of human error intervening. It also leads to becoming

In the security risk assessment device, the loss cost when the risk materializes is estimated based on the risk probability calculated by the risk analysis unit 42 and predetermined asset value information, and the estimated loss cost is calculated in advance. The present invention is characterized in that it further includes a risk evaluation unit 43 that determines that the risk is acceptable if the risk is smaller than a predetermined risk standard.

By doing so, in the security risk assessment device, the risk evaluation unit 43 can obtain an estimated loss cost based on the risk probability and the asset value information input by the system administrator or the like. Further, the risk evaluation unit 43 can automatically determine the acceptability of the risk based on the estimated loss cost and the risk criteria input by the system administrator or the like.

In the security risk assessment device, the nodes of the analysis graph are nodes representing either the start port, end port, or vulnerability in the host, and the risk identification unit 41 collects traffic and data as security information collected over a predetermined period. A first process that describes the dependencies between hosts by classifying multiple hosts in the network system into multiple host groups according to their distance from the outside based on a warning against unauthorized communication; and a first process that describes the dependencies between the hosts. According to a second process that calculates the weight of the edge; a third process that calculates the probability that the vulnerability will be accessed from the end port and exploited within each host as the weight of the edge between the nodes; A fourth process in each host that calculates the probability of unauthorized communication from the source port after the vulnerability is exploited as the weight of the edge between the nodes, and sets the state variable of each node based on the alert. The present invention is characterized in that an analytical graph is created by performing the fifth process.

By doing so, in the security risk assessment device, the risk identification unit 41 can calculate the probability that unauthorized communication from outside the network system will propagate from the source port to the destination port as the weight of the edge. Furthermore, the risk identification unit 41 can calculate the probability that propagation of unauthorized communication from the outside will lead to a vulnerability attack, etc. as the edge weight.

In the security risk assessment device, the risk analysis unit 42 sequentially calculates the expected value of the state variable of the node along the direction of the edge in the analysis graph, assuming that the weight of each edge is a conditional probability regarding the state variable of the node. It is characterized by calculating and updating.

By doing so, the risk analysis unit 42 performs calculations by regarding the weight of the edge extending from the end port to the vulnerability as the probability that the vulnerability will be exploited if unauthorized communication reaches the end port. be able to. Furthermore, the risk analysis unit 42 can perform calculations by regarding the weight of the edge extending from the vulnerability to the source port as the probability that unauthorized communication will occur from the source port if the vulnerability is exploited. Further, the risk analysis unit 42 can perform calculations by regarding the weight of the edge extending from the start port to the end port as the probability that the fraudulent communication will arrive at the end port if the unauthorized communication has arrived at the start port. .

The security risk assessment system includes an information acquisition unit 10 that automatically collects security information regarding information assets, vulnerabilities, and threats in a network system collected by a plurality of security devices, and security information acquired by the information acquisition unit 10. The security risk assessment device 40 includes a data processing unit 20 that processes data to format the information according to predetermined requirements and stores data associated with the time at which security information was collected in a database 30, and the security risk assessment device 40. is characterized in that an analysis graph is created based on data stored in the database 30.

By doing so, the database 30 receives a predetermined period as a query from the risk identification unit 41 of the security risk assessment device 40, and provides each data regarding information assets, vulnerabilities, and threats for the predetermined period to the risk identification unit 41. can do.

The security risk assessment method is a security risk assessment method performed by the security risk assessment device 40, in which the security risk assessment device 40 performs security assessment on information assets, vulnerabilities, and threats in a network system, each collected by a plurality of security devices. A step of identifying security risks inherent in the network system based on the information, and creating an analytical graph that describes the probabilistic dependencies of the identified security risks in the form of an acyclic directed graph; and a step of using the analytical graph. and calculating a risk probability regarding the state of the node.

By doing so, in the security risk assessment method, the security risk assessment device 40 can calculate the probability that unauthorized communication has reached each information asset in the network system based on the security information. Furthermore, the security risk assessment device 40 can calculate the probability that each vulnerability in the network system has been exploited based on the security information. Therefore, a system administrator or the like can refer to the risk probability calculated by the security risk assessment device 40 without manually creating a BN.

In the security risk assessment method, the security risk assessment device 40 estimates the loss cost when the risk materializes based on the risk probability and predetermined asset value information, and the estimated loss cost is calculated in advance. If the risk is smaller than a predetermined risk standard, the method further includes determining that the risk is acceptable.

By doing so, in the security risk assessment method, the security risk assessment device 40 can obtain an estimated loss cost based on the risk probability and the asset value information input by the system administrator or the like. Furthermore, the security risk assessment device 40 can automatically determine the acceptability of the risk based on the estimated loss cost and the risk criteria input by the system administrator or the like.

Note that the present invention is not limited to the embodiments described above, and many modifications can be made within the technical idea of the present invention by those having ordinary knowledge in this field.

1, 1B Security risk assessment system 10 Information acquisition unit 11 Network flow information acquisition unit 12 Vulnerability information acquisition unit 13 Threat

information acquisition unit

20, 20B Data processing unit 30

Database

40, 40B Risk assessment unit (security risk assessment device)
41 Risk Identification Department 42 Risk Analysis Department 43 Risk Evaluation Department 50 Assessment Results Output Department 60 Asset Value Information Input Department

Claims

Based on the security information regarding information assets, vulnerabilities, and threats within the network system collected by multiple security devices, the security risks inherent in the network system are identified, and the probabilistic analysis of the identified security risks is performed. a risk identification unit that creates an analysis graph that describes dependencies in the form of an acyclic directed graph;
A security risk assessment device comprising: a risk analysis unit that calculates a risk probability regarding the state of a node using the analysis graph.
Based on the risk probability calculated by the risk analysis department and predetermined asset value information, the loss cost when the risk materializes is estimated, and the estimated loss cost is calculated based on the predetermined risk standard. 2. The security risk assessment device according to claim 1, further comprising a risk evaluation unit that determines that the risk is acceptable if the risk is also small.
The nodes of the analysis graph are nodes representing either a starting port, an ending port, or a vulnerability in the host,
The risk identification department is
Dependency between hosts is reduced by classifying multiple hosts within the network system into multiple host groups according to distance from the outside based on traffic volume as security information collected over a predetermined period and warnings against unauthorized communications. a first process of describing the relationship;
The probability that unauthorized communication will flow between a starting point port of a host included in a predetermined host group and a destination port of a host included in another host group that depends on the predetermined host group, according to the dependency relationship between the hosts. a second process of calculating the weight of the edge between the nodes;
a third process of calculating the probability that the vulnerability will be accessed from the end port and exploited in each host as the weight of the edge between the nodes;
a fourth process of calculating the probability that unauthorized communication will be performed from the source port after the vulnerability is exploited in each host as the weight of the edge between the nodes;
3. The security risk assessment device according to claim 1, wherein the analysis graph is created by performing a fifth process of setting a state variable of each node based on the alarm.
The risk analysis unit sequentially calculates and updates the expected value of the state variable of the node along the direction of the edge, assuming that the weight of each edge is a conditional probability regarding the state variable of the node in the analysis graph. The security risk assessment device according to claim 3, characterized in that:
an information acquisition unit that automatically collects security information regarding information assets, vulnerabilities, and threats in the network system collected by a plurality of security devices;
a data processing unit that formats the security information acquired by the information acquisition unit according to predetermined requirements and stores data associated with the time at which the security information was collected in a database;
The security risk assessment device according to claim 1 or claim 2,
A security risk assessment system, wherein the security risk assessment device creates the analysis graph based on data stored in the database.
A security risk assessment method for a security risk assessment device, the method comprising:
The security risk assessment device includes:
Based on the security information regarding information assets, vulnerabilities, and threats within the network system collected by multiple security devices, the security risks inherent in the network system are identified, and the probabilistic analysis of the identified security risks is performed. a step of creating an analytic graph that describes the dependencies in the form of an acyclic directed graph;
calculating a risk probability regarding the state of the node using the analysis graph;
A security risk assessment method characterized by performing.
The security risk assessment device includes:
The loss cost when the risk materializes is estimated based on the risk probability and predetermined asset value information, and if the estimated loss cost is smaller than the predetermined risk standard, the risk is 7. The security risk assessment method according to claim 6, further comprising determining that the security risk assessment method is acceptable.
A program for causing a computer to function as the security risk assessment device according to claim 1 or 2.