WO2024048040A1

WO2024048040A1 - Security risk assessment assistance method and security risk assessment assistance system

Info

Publication number: WO2024048040A1
Application number: PCT/JP2023/023584
Authority: WO
Inventors: 浩通遠藤; 直樹出口
Original assignee: 株式会社日立製作所
Priority date: 2022-09-02
Filing date: 2023-06-26
Publication date: 2024-03-07
Also published as: JP2024035327A

Abstract

This security risk assessment assistance method includes: a configuration information input step in which input of configuration information regarding a target system configured so as to include component devices is received; and an attack route search step in which the configuration information is used as a basis to perform a search for attack routes in which an attack on the target system passes through the component devices. In addition, the security risk assessment assistance method includes an attack scenario generation step in which an attack scenario is generated by arranging attack routes by the order in which attacks pass through the component devices, it is estimated on the basis of a performance model in which the configuration of the component devices is represented from a functional perspective which attack types correspond to the form in which the operations of the component devices constituting the attack routes are obstructed by attacks, and the estimated attack types are reflected in the attack scenario. The security risk assessment assistance method also includes an attack scenario presentation step in which an attack scenario is presented.

Description

Security risk assessment support method and security risk assessment support system

The present invention relates to a security risk assessment support method and a security risk assessment support system.

Regardless of whether it is an information system (IT system) or a control system (OT system) for social infrastructure or industry, a security risk assessment is performed in order to implement appropriate security measures for the system. It is important to accurately identify security threats to the target system and the series of effects caused by these threats through security risk assessment.

Since the results of security risk assessments greatly influence the subsequent planning and implementation process of security measures, attempts have been made to conduct them using objective criteria. For example, Patent Document 1 states, ``Attack route information (21) includes information on an attack route that includes one or more attack steps including an attack source, an attack target, and an attack method. The route information (21) is referenced to identify vulnerabilities used to attack the target in the attack step.The vulnerability information DB (22) stores vulnerabilities and the presence or absence of attack demonstration code for the vulnerabilities. The diagnostic evaluation generation means (12) refers to the vulnerability information DB (22), checks whether or not an attack demonstration code exists for the identified vulnerability, and performs the attack step. ``generate a risk diagnosis assessment including the number of identified vulnerabilities and the presence or absence of proof-of-attack code.''

International Publication No. 2021/059471

When a vendor sells a system or when an operator obtains third-party certification of system security, proof is required through a security risk assessment that threats have been accurately identified and countermeasures have been taken. In particular, it is important that all threats to the target system are identified (comprehensiveness); if unidentified threats remain, no matter how strictly other threats are dealt with, appropriate countermeasures will not be taken. cannot claim that it is

However, in the conventional security risk assessment method, specific attack methods such as "unauthorized operation" and "data falsification" are considered as components of the attack scenario (corresponding to a series of attack steps that occur on the attack path in Patent Document 1). I am using it. Therefore, in order to understand attack scenarios obtained through security risk assessment, knowledge of specific attack methods is required. Furthermore, the attack methods referred to in the prior art are merely an accumulation of known attack methods, and it is not for security experts to judge whether they cover all possible attack methods. difficult for people. In other words, it is difficult to claim comprehensiveness of threats to the target system in attack scenarios described using specific attack methods.

Furthermore, when the target system is composed of multiple domains (for example, wide-area infrastructure such as railways and roads with multiple business entities, or structures such as service businesses that utilize such infrastructure and it), Preconditions such as threat sources and conditions for damage caused by attacks may differ depending on the domain, making it more difficult to cover threats for the entire system.

The present invention has been made in consideration of the above points, and it is an object of the present invention to provide a security risk assessment support method and a security risk assessment support system that can completely grasp threats to a target system.

In order to solve the above-mentioned problems, one aspect of the present invention provides a security risk assessment support method executed by a security risk assessment support system, which is configured to receive input of configuration information regarding a target system including component devices. an information input step; an attack route searching step of searching for an attack route in which an attack on the target system passes through the component devices based on the configuration information; and searching the attack route in the order in which the attack passes through the component devices. A functional model that expresses the configuration of the component devices from a functional perspective by generating attack scenarios side by side and determining which attack type corresponds to the form in which the operation of the component devices constituting the attack path is inhibited by the attack. and an attack scenario presentation step for presenting the attack scenario generated by the attack scenario generation step. shall be.

According to the present invention, threats to a target system can be completely understood in a security risk assessment.

A diagram showing the configuration of an analysis target system. The figure which shows the structure of the component equipment of the analysis target system. A diagram for explaining a functional model of component devices. FIG. 3 is a diagram illustrating, in a functional model, a form in which the expected original operation of a component device is obstructed. FIG. 3 is a diagram showing a correspondence table between combinations of movement elements and inhibition forms and attack methods. FIG. 3 is a diagram illustrating occurrence event correspondence information indicating a correspondence relationship between an attack means and an event that may occur due to an attack. FIG. 1 is a diagram showing the configuration of a security risk assessment support system. Flowchart showing risk assessment processing. FIG. 3 is a diagram showing the configuration of a system to be analyzed, a functional model of each component device that constitutes the system to be analyzed, and device configuration information. FIG. 4 is a diagram showing a menu display and a configuration diagram display of a device configuration information input GUI. The figure which shows the example of information input to a device configuration information input GUI. The figure which shows scenario information display GUI16D2 which displays attack scenario information. A diagram for explaining attack stages. FIG. 4 is a diagram for explaining inhibition forms and attack means estimation. The figure which shows the detail processing confirmation screen of attack scenario information. FIG. 3 is a diagram for explaining detailed information input processing. A diagram showing detailed information on attack methods and occurrence events. A diagram showing detailed attack scenario information.

Hereinafter, embodiments according to the technology disclosed in the present application will be described with reference to the drawings. The embodiments, including the drawings, are examples for explaining the present application. In the embodiments, omissions and simplifications are appropriately made for clarity of explanation. Unless otherwise limited, each component in the embodiments may be singular or plural.

Identical or similar components are given the same reference numerals, and explanations of the previously described components in the later embodiments may be omitted or may focus on differences.

If there are multiple identical or similar components, different subscripts may be attached to the same reference numerals to distinguish them from each other. Furthermore, if there is no need to distinguish between these multiple components, the subscripts may be omitted from the description.

In the following embodiments, various information will be explained in a table format, but the various information may be in a data format other than the table format. Furthermore, various names such as "XX information", "XX table", "XX list", and "XX queue" are interchangeable. For example, "XX information" may be called "XX table". Furthermore, when describing identification information, expressions such as "identification information", "identifier", "name", "ID", and "number" are interchangeable.

[Embodiment]
(System configuration)
First, the system under consideration (hereinafter referred to as SuC), which is the target of risk assessment, will be explained. FIG. 1 is a diagram showing the configuration of SuC10. FIG. 2 is a diagram showing the configuration of the component equipment 100 of the SuC 10. The SuC 10 is, for example, a control system, but is not limited to this, and may be an information processing system or other system.

The SuC 10 includes

component devices

100a, 100b, 100c, and 100d. The component devices 100 are interconnected inside the SuC 10. Further, each component device 100 has input I/Fs (interfaces) 101a, 101b, . . . and an output I/F (not shown), as shown in FIG. The input I/F 101 is used for mutual connection of the component devices 100 and for connection of the SuC 10 with the outside. The numbers of component devices 100 and input I/Fs 101 in this embodiment are merely examples. Further, the number of component devices 100 and input I/Fs 101 differs for each SuC 10.

(Definition of attack types)
In this embodiment, attack means that may occur in an attack scenario are identified by "attack type" defined by the function of the component device 100 that is inhibited by the attack and the mode of inhibition of the function. The concept will be explained below.

FIG. 3 is a diagram for explaining the functional model M100 of the component device 100. The functional model M100 is, for example, a control device such as a PLC (Programmable Logic Controller) or a processing device (computer). In the functional model M100, specific elements such as actually provided hardware are omitted. The functional model M100 represents the configuration of the component device 100 from a functional perspective.

Appropriate "behavior elements" are given to the functional model M100 to achieve the expected behavior. In this embodiment, operational elements include "logic" M101 such as programs and control rules, "input" M102 given from sensors and users, "output" M103 output by the functional model M100, etc. There is. Depending on the type of component represented by the functional model M100, there may be operational elements other than "logic," "sensor," "input," and "output." Furthermore, "logic," "sensor," "input," and "output" may be defined subdivided.

Attacks on component devices are considered to be when unintended operation elements such as logic and inputs are given to the component device, thereby inhibiting the expected original operation of the component device. be able to. "Unintended" means that various attributes of the operational element, such as data format, processing timing, and various values, violate or deviate from those specified in the operational specifications of the component device.

FIG. 4 is a functional model showing a form in which the expected original operation of the component device 100 is inhibited. For example, as shown in FIG. 4, forms in which the original operation of the component device 100 is inhibited by the provision of an "unintended" operational element as described above include (a) invalid operational element input (invalid); It can be classified into three forms of inhibition: b) falsified input action element, and (c) input action element from an untrusted party (untrusted).

(a) shows a form of inhibition in which an unintended operating element ae1 is generated for some reason in the attacking component (component model M100A-a) and is given to the victim component (component model M100V-a). It is.

In (b), the operation element ae2 given from the attacker's component (component model M100A-b) to the victim's component (component model M100V-b) is changed to something unintended for some reason. This is the form of inhibition.

In (c), an unintended operating element ae3 is generated in a component (component model M100A-c) that is not allowed to be connected to the victim component (component model M100V-c) according to the specifications. , is a form of inhibition given to the component equipment on the victim side.

Note that in the above-mentioned attack types, the form of inhibition of the operation of the component equipment differs depending on which layer the unintended and unauthorized operation element input corresponds to. For this reason, in conventional attack classification, even if the input of the same fraudulent action element is in different layers, it is considered to be a different attack. However, in this embodiment, the same invalid action element input can be included and expressed in different layers.

For example, the data that is "input" in a PLC includes not only pure input values to the control logic (corresponding to the application layer in the so-called OSI model), but also data formats (also equivalent to the presentation layer), protocol headers (also the session layer, (equivalent to network layer, etc.). If each of these is unintended, it manifests as a different attack such as unintended control output, buffer overflow, or replay attack.

In addition, the range of expression of attack methods can be expanded by adding attributes to behavioral elements, such as allowing eavesdropping to be selected as an attack method when "input" is "unencrypted". can.

FIG. 5 is a diagram showing attack means correspondence information 201 indicating the correspondence between combinations of operation elements (“logic” and “input”) and inhibition forms ((a) to (c) in FIG. 4) and attack means. . The attack means correspondence information 201 shows "attack means 1" to "attack means 6" corresponding to each of the combinations of operation elements and inhibition forms shown in FIG. The attack method correspondence information 201 includes operational elements handled by the input I/F 101 of the component device 100 and forms of obstruction to the connection between this input I/F and the component device 100 in the preceding stage ((a) to (c) above). This shows the types or outlines of attacks that can occur in combination with the above, and the types or outlines of events that can occur due to attacks. The attack means correspondence information 201 is stored in the storage device 13 (FIG. 7) of the security risk assessment support system 1.

FIG. 6 is a diagram showing occurrence event correspondence information 202 indicating the correspondence between attack means and events that may occur due to the attack. The occurrence event correspondence information 202 shows types or outlines of "events that may occur due to attacks" corresponding to each of the attack means 1 to 6 in FIG. 5. “Events that may occur due to an attack” include a score for each event that represents the degree of security risk caused to the target system due to the attack, for example, on a scale of 5 from 1 to 5. In FIG. 6, the numbers written in parentheses next to each event correspond to this score. The event response information 202 is stored in the storage device 13 (FIG. 7) of the security risk assessment support system 1.

(Configuration of security risk assessment support system)
FIG. 7 is a diagram showing the configuration of the security risk assessment support system 1. The security risk assessment support system 1 is realized by a computer executing a risk assessment support program. The security risk assessment support system 1 is an on-premises or cloud system.

The security risk assessment support system 1 includes a processor 11, a memory 12, a storage device 13, a communication device 14, an input device 15, and an output device 16. The processor 11, memory 12, storage device 13, communication device 14, input device 15, and output device 16 are interconnected via an internal communication line such as a bus.

The processor 11 controls the entire operation of the security risk assessment support system 1 as a computer. The memory 12 is composed of, for example, a volatile semiconductor memory, and is used as a work memory of the processor 11.

The storage device 13 is an example of a computer-readable non-temporary storage medium, and is composed of a large-capacity nonvolatile storage device such as a hard disk device, an SSD (Solid State Drive), or a flash memory. The storage device 13 includes device configuration information 200 (FIG. 9), attack method correspondence information 201 (FIG. 5), event correspondence information 202 (FIG. 6), detailed information 203 (FIG. 16), and detailed information 204 (FIG. 17). , and attack scenario information 205 (FIGS. 12 and 18). Note that the device configuration information 200, attack means correspondence information 201, occurrence event correspondence information 202, detailed information 203, detailed information 204, and attack scenario information 205 may be stored in the memory 12.

Additionally, the storage device 13 stores various programs and data. A program stored in the storage device 13 is loaded into the memory 12 when the security risk assessment support system 1 is activated or when necessary, and is executed by the processor 11. Thereby, the processor 11 realizes each functional unit of a device configuration information input unit 111, an attack path search unit 112, an attack scenario generation unit 113, and an attack scenario presentation unit 114. The processing functions of the device configuration information input section 111, the attack route search section 112, the attack scenario generation section 113, and the attack scenario presentation section 114 will be described later with reference to the flowchart of FIG.

Note that the program executed by the processor 11 may be recorded on a non-temporary recording medium, read from the non-temporary recording medium by a medium reading device, and loaded into the memory 12. Alternatively, the executable program may be obtained from an external computer via a network and loaded into memory 12.

The communication device 14 is an interface device for the security risk assessment support system 1 as a computer to communicate with other computers. The communication device 14 includes, for example, a NIC (Network Interface Card) such as a wired LAN (Local Area Network) or a wireless LAN.

The input device 15 is comprised of a keyboard, a pointing device such as a mouse, a touch device, etc., and is used by the user to input various instructions and information to the security risk assessment support system 1. The output device 16 includes, for example, a display device such as a liquid crystal display or an organic EL (Electro Luminescence) display, and an audio output device such as a speaker, and is used to present necessary information to the user when necessary.

Note that FIG. 7 shows an example in which the security risk assessment support system 1 is implemented on one computer. However, the present invention is not limited to this, and the security risk assessment support system 1 may be realized by distributing each processing function on a plurality of communicably connected computers.

(Risk assessment processing)
FIG. 8 is a flowchart showing the risk assessment process. The security risk assessment support system 1 executes risk assessment processing in response to a user instruction.

First, in step S1, the device configuration information input unit 111 (FIG. 7) executes device configuration information input processing to receive the input of the device configuration of the SuC 10 by the user and create device configuration information 200.

The device configuration information input process in step S1 will be described with reference to FIGS. 9 to 11. FIG. 9 is a diagram showing the configuration of the SuC 10, a functional model M100 of each component device 100 that makes up the SuC 10, and device configuration information 200. As shown in FIG. 9, in step S1, based on the functional model M100 of each component 100 constituting the SuC 10, the "device ID", "device name", "number of inputs", and "input I/F1" of each component 100 are determined. Device configuration information 200 having items of "input I/F2" and "output destination" is created. "Input I/F1", "Input I/F2", etc. include the "ID" and "name" of each input I/F, and the "operation element" handled by the corresponding input I/F. In the device configuration information input process, configuration information of the component device 100 is input according to the functional model M100. By inputting the configuration information of the component device 100 according to the functional model M100, an attack scenario can be evaluated without detailed knowledge of the specifications or security vulnerabilities of the SuC 10 or the component device 100.

FIG. 10 is a diagram showing a menu display 300 and a configuration diagram display 310 of the device configuration information input GUI (Graphical User Interface) 16D1. In step S1, the device configuration information input unit 111 displays the device configuration information input GUI 16D1 on the display screen of the output device 16. The device configuration information input GUI 16D1 includes a menu display 300 and a configuration diagram display 310. The menu display 300 includes a component creation button 301, an input I/F creation button 302, an input/output relationship creation button 303, a delete button 304, and a setting button 305.

The component creation button 301 is a button for creating the SuC 10 and the component device 100 on the configuration diagram display 310. SuC 10 or component device 100 is created at the clicked position with component creation button 301 turned on. Further, the component device 100 is created inside the SuC 10 that is clicked with the component device creation button 301 turned on.

The input I/F creation button 302 is a button for creating the input I/F 101 of the component device 100 on the configuration diagram display 310. An input I/F 101 is created at the position clicked with the input I/F creation button 302 turned on.

The input/output relationship creation button 303 is a button for creating the input/output relationship 102 between the component devices 100. An input/output relationship 102 between the component devices 100 is created at the dragged (or swiped) position with the input/output relationship creation button 303 turned on.

The delete button 304 is a button for deleting the component device 100, input I/F 101, and input/output relationship 102 from the configuration diagram display 310. The component device 100, input I/F 101, and input/output relationship 102 at the clicked position with the delete button 304 turned on are deleted.

The settings button 305 is a button for transitioning to an input screen that accepts input of various setting information of the device configuration information input GUI 16D1.

The user operates each button on the menu display 300 to display a configuration diagram display 310 of the SuC 10 having a component device 100, an input I/F 101, and an input/output relationship 102, as shown in FIG. 10, for example, with device configuration information. Create it in the input GUI 16D1. Information about the component equipment 100, input I/F 101, and input/output relationship 102 of the ScU 10 for which the configuration diagram display 310 has been created in the equipment configuration information input GUI 16D1 is automatically reflected in the equipment configuration information 200 for each ScU 10.

FIG. 11 is a diagram showing an example of information input to the device configuration information input GUI 16D1. When a new ScU 10 is created on the configuration diagram display 310 of the equipment configuration information input GUI 16D1, a template of equipment configuration information 200 corresponding to the newly created ScU 10 is created.

When a component device 100 is created inside the ScU 10 in the configuration diagram display 310 on the device configuration information input GUI 16D1, a row of device configuration information 200 corresponding to the newly created component device 100 is created. On the configuration diagram display 310 of the device configuration information input GUI 16D1, when the input I/F 101 is created inside the component device 100, the "ID" and "name" of the device configuration information 200 corresponding to the newly created input I/F 101 are displayed. An item of "behavior element" is created. The values of each item of "ID", "name", and "operation element" of the device configuration information 200 are input by the user.

Furthermore, when the input/output relationship 102 of the component device 100 is newly created on the configuration diagram display 310 of the device configuration information input GUI 16D1, a line of device configuration information 200 regarding the newly created input/output relationship 102 is created. For example, as shown in FIG. 10, when a component device 100c on a configuration diagram display 310 is double-clicked, device configuration information 200 is displayed as a pop-up. It becomes possible to input each piece of information into the row corresponding to the component device 100c of the device configuration information 200 being displayed as a pop-up. Each piece of information is input to the row corresponding to the component device 100c of the device configuration information 200 in accordance with the device model (not shown) of the component device 100c.

Specifically, since the input I/F 101c-1 of the component device 100c is an "input" operation element, the "ID", "name", and "operation" of the "input I/F 1" corresponding to the input I/F 101c-1 are "101c-1", "input1", and "input" are input to "Element". Similarly, since the input I/F 101c-2 of the component device 100c is an "input" operation element, the "ID", "name", and "operation element" of the "input I/F 2" corresponding to the input I/F 101c-2 are "101c-2", "input2", and "input" are input to. Furthermore, the output of the component device 100c is input to the input I/F 101d-1 of the component device 100d. Therefore, "101d-1" is input to the "output destination" of the component device 100c.

Note that the operation element of the input I/F 101d-2 of the component device 100d is "logic (maintenance)". Therefore, in the row of "Device ID" "100d" of the device configuration information 200 in FIG. ” is input. Further, the output of the component device 100d is output to the outside of the SuC 10. Therefore, "SYSOUT" is input to the "output destination" of the component device 100d.

Additionally, on the configuration diagram display 310 of the device configuration information input GUI 16D1, information on the input I/F 101 for which the input/output relationship 102 has been created is automatically reflected in the device configuration information 200. For example, on the configuration diagram display 310 of the device configuration information input GUI 16D1, if the output destination of the component device 100c is connected to the input I/F 101d-1 of the component device 100d, the device configuration information corresponding to the component device 100c is displayed as a pop-up. Input I/F 101d-1 is also stored in the "output destination" column of row 200. Conversely, when the connection destination of the input I/F 101 is stored in the table of the device configuration information 200, it is reflected in the configuration diagram display 310 of the device configuration information input GUI 16D1.

Next, in step S2, the attack route search unit 112 executes an attack route search process based on the device configuration information 200 created in step S1. Based on the device configuration information 200 created in step S1, the attack path search unit 112 performs a search between the input I/F 101 connected to the outside of the SuC 10 and the output I/F (SYSOUT) connected to the outside of the SuC 10. By tracing the connections between existing component devices 100, candidates for attack routes in the SuC 10 are searched.

In the example of the SuC 10 and device configuration information 200 shown in FIG. 9, three attack routes are identified. That is, attack route 1: external → component device 100a → component device 100c → component device 100d → external, attack route 2: external → component device 100b → component device 100c → component device 100d → external, attack route 3: external → attack route 3: Component device 100d→external.

Next, in step S3, the attack scenario generation unit 113 executes an attack scenario generation process including estimating "attack means" and "events that may occur due to the attack" based on the result of the attack route search process in step S3. . For example, assume that the three attack routes 1 to 3 described above are identified based on the device configuration information 200 shown in FIG. The attack scenario generation unit 113 generates attack scenario information 205 including attack scenarios AS1, AS1, and AS3 corresponding to each attack route.

FIG. 12 is a diagram showing the scenario information display GUI 16D2 that displays the attack scenario information 205. As shown in FIG. 12, the attack scenario information 205 includes "attack scenario ID", "attack stage ID", "attack source component ID", "attack target component ID", "attack target input I/F_ID", "configuration device connection type". It has items such as "Details", "Predicted attack form", "Attack method", and "Events that may occur due to attack".

The "attack scenario ID" is identification information of an attack scenario, and an ID is assigned to each attack route specified based on the device configuration information 200. In the example of FIG. 12, the "attack scenario IDs" of the attack scenarios created for each of the three attack routes identified above based on the device configuration information 200 (FIG. 9) are attack scenarios AS1, AS2, and AS3. The attack scenario is a sequence of attack paths arranged in the order in which the attack passes through the component devices 100.

"Attack stage ID" is identification information of each attack stage that constitutes each attack scenario. FIG. 13 is a diagram for explaining the attack stage. The attack scenario AS1 illustrated in FIG. 12 corresponds to an attack path 1 from the outside to the component device 100a to the component device 100c to the component device 100d to the outside. Therefore, in the attack scenario AS1, as shown in FIG. 13, attack stage AS1-1: external → component device 100a, attack stage AS1-2: component device 100a → component device 100c, attack stage AS1-3: component device 100c → component device Consists of three attack stages of 100d. In attack scenario AS2 and subsequent stages, which are the second stage, the component device 100 that was attacked in the previous stage becomes a springboard for an attack on the component device 100 in the next stage due to malfunction due to the attack or malicious operation by the attacker. Become.

Note that the attack scenario is generated by arranging the types of attacks predicted for each component device 100 in the order in which data passes through each component device 100.

"Attack source component ID" and "attack target component ID" indicate the attack source and target component devices 100 in the attack path of the corresponding attack stage. As can be seen from FIG. 13, in the attack stage AS1-1, an external attacker becomes the direct attack source and the component device 100a becomes the attack target, so the "attack source component device ID" is "attacker (external)", The “attack target component device ID” becomes the component device 100a. Similarly, in the attack stage AS1-2, the component device 100a becomes the attack source and the component device 100c becomes the attack target, so the "attack source component ID" is the component device 100a, and the "attack target component ID" is the component device. It becomes 100c. Similarly, in the attack stage AS1-3, the component 100c becomes the attack source and the component 100d becomes the attack target, so the "attack source component ID" is the component 100c, and the "attack target component ID" is the component It becomes 100d.

"Attack target input I/F_ID" indicates the input I/F 101 of the attack target component device 100 in the attack path of the corresponding attack stage. As can be seen from FIG. 13, in the attack stage AS1-1, the attack source destination is the input I/F 101a-1 of the component device 100a, so the "attack destination input I/F_ID" becomes the input I/F 101a-1. Similarly, in the attack stage AS1-2, the attack source target is the input I/F 101c-1 of the component device 100c, so the "attack target input I/F_ID" becomes the input I/F 101c-1. Similarly, in the attack stage AS1-3, the attack source destination is the input I/F 101d-1 of the component device 100d, so the "attack destination input I/F_ID" becomes the input I/F 101d-1.

"Component connection configuration details" is information stored based on detailed information 203 input through detailed information addition input processing (step S6 in FIG. 8), which will be described later. Immediately after step S3 is executed, the detailed information 203 has not been input, so "(not input)" is stored in the "configuration device connection form details".

The "predicted attack form" includes the items "target movement element" and "obstruction form". “Target action element” indicates the action element targeted by the corresponding attack stage. FIG. 14 is a diagram for explaining the inhibition mode and attack method estimation. In the example of FIG. 14, in the attack stage AS1-2 from the component device 100a to the component device 100c, the operation mode of the input I/F 101c-1 is "input". Which "obstruction mode" corresponds to the attack stage depends on the connection mode of the input I/F 101 of the component 100 that is the target of the attack stage, but if the "component device connection mode details" are not entered. In the case of , all forms of inhibition assumed for the "corresponding motion element" are stored. Therefore, from the attack method correspondence information 201 (FIG. 5), all the inhibition modes (a), (b), and (c) correspond to the "motion element" "input" of the attack stage AS1-2 in FIG. ) is reflected.

"Attack Means" indicates an attack means corresponding to the combination of "Target Motion Element" and "Inhibition Form" in the attack means correspondence information 201 (FIG. 5). In the example of FIG. 14, the combination of "target operation element" "input" and "obstruction form" "(a)" of attack stage AS1-2 from component device 100a to component device 100c is supported in attack means correspondence information 201. ``Attack Means'' and ``Attack Means 4'' are stored. Similarly, for the combination of "target action element" "input" and "inhibition mode" "(b)", the corresponding "attack means" "attack means 5" is stored in the attack means correspondence information 201. Similarly, for the combination of “target action element” “input” and “inhibition form” “(c)”, the corresponding “attack means” “attack means 6” is stored in the attack means correspondence information 201.

"Events that may occur due to attacks" indicate events, effects, etc. that are expected to occur due to each "attack method" that corresponds to each "attack method" in the event correspondence information 202 (FIG. 6). "Events that may occur due to attacks" correspond to "Attack Means" and "Attack Means 4," and the corresponding "Events that may occur due to attacks" "Event 4 (5)" are reflected in the event correspondence information 202. ing. Similarly, corresponding to the "attack means" and "attack means 5", the corresponding "event 5 (4)", which is an "event that may occur due to an attack", is reflected in the occurrence event correspondence information 202. Similarly, corresponding to the "attack means" and "attack means 6," the corresponding "event that may occur due to an attack" "event 6 (5)" is reflected in the event correspondence information 202.

The number written in parentheses next to "Events that may occur due to an attack" is a score for each event that represents the degree of security risk caused to the target system due to the attack, for example, on a five-point scale from 1 to 5. This score allows you to intuitively understand the degree of security risk for each attack route. Furthermore, by summing up the scores for each attack scenario, the degree of security risk can be intuitively grasped for each attack scenario. Additionally, as a result of the security risk assessment, priority areas to be addressed can be selected based on the score.

Next, in step S4, the attack scenario presentation unit 114 presents the attack scenario generated in step S3 to the user. The attack scenario presentation unit 114 outputs the attack scenario information 205 to the user via the scenario information display GUI 16D2 (FIG. 12) on the output device 16, as illustrated in FIG. 12, for example.

Up to this stage, the attack methods included in the generated attack scenario are expressed in terms of the behavior model of the component devices and the form of inhibition, so if you are a user with knowledge of SuC, you may not have specialized knowledge of attack methods. However, you can get a rough idea of the risks posed by attack scenarios. However, after this, when the attack scenario is transferred to countermeasure planning, information regarding the specific attack mechanism is required, so a step is required to refine the attack scenario in accordance with the user's wishes. The details will be explained below.

Next, in step S5, the attack scenario presentation unit 114 determines whether the user has made an input requesting the attack scenario to be detailed. The attack scenario presentation unit 114 moves the process to step S6 when the user inputs a request to make the attack scenario more detailed (step S5 YES), and when the user does not input an input requesting the more detailed attack scenario (step S5), the attack scenario presentation unit 114 moves the process to step S6. S5NO), the present risk assessment process ends. In addition, in step S5, the attack scenario presentation unit 114 does not limit to whether the user inputs a request to make the attack scenario more detailed; ) may be determined whether it is satisfied.

In step S5, the attack scenario presentation unit 114 inputs to the user whether or not the detailedization of the attack scenario information 205 is necessary via the detailedization confirmation GUI 16D3 on the output device 16, as illustrated in FIG. 15, for example. let When the row of the component device 100 that is desired to be detailed in the attack scenario information 205 is double-clicked, a detailedization confirmation GUI 16D3 is displayed as shown in FIG. When "Yes (Y)" is clicked on the detailed implementation necessity confirmation GUI 16D3, a detailed information input window 16D4 is displayed on the device configuration information input GUI 16D1, as shown in FIG. Steps S5-S7 are repeated as long as the user desires.

In step S6, the device configuration information input unit 111 executes detailed information addition input processing. The device configuration information input unit 111 inputs details for making the attack scenario information 205 detailed through a detailed information input window 16D4 displayed on the device configuration information input GUI 16D1 on the output device 16, as illustrated in FIG. 16, for example. The information 203 is input by the user and accepted.

The detailed information 203 is information for each component device 100. As shown in FIG. 16, the detailed information 203 includes the "name" and "version" of the "installed OS", the "name" and "version" of the "installed software", the "connection type" and "additional attributes" of the "input I/F_ID". ”. It is up to the user whether or not values corresponding to each of these items are actually stored.

"Connection type" of "Input I/F_ID" indicates the connection standard of the corresponding input I/F 101, such as "Ethernet" (registered trademark, hereinafter the same), "RS-232C", "signal line", etc. . The "additional attribute" of the "input I/F_ID" is information including one or more attributes other than the connection standard of the corresponding input I/F 101, and includes, for example, "inside the casing" and "outside the casing" indicating the connection location.

The device configuration information input unit 111 stores detailed information 203 input by the user in the storage device 13 and reflects it in the attack scenario information 205.

Next, in step S7, the attack scenario generation unit 113 executes attack scenario detailing processing that includes estimating detailed attack methods and events that may occur due to the attack, based on the detailed information 203 input in step S6.

In the attack scenario detailing process, the attack scenario generation unit 113 first reflects the detailed information 203 input in step S6 in the attack scenario information 205. FIG. 18 is a diagram showing detailed attack scenario information 205. In the example shown in FIG. 18, the "connection mode" and "additional attribute" of the detailed information 203 are stored in the "configuration device connection mode details" of the corresponding input I/F 101 in the attack scenario information 205. In addition, although not shown, the value of an item in the detailed information 203 may be stored as the value of a corresponding item in the attack scenario information 205.

Next, the attack scenario generation unit 113 re-estimates the "obstruction form", "attack means", and "events that may occur due to the attack" in the attack scenario information 205 that reflects the detailed information 203. As for the "inhibition form," an inhibition form that cannot be realized is excluded by re-estimation. For example, if the component devices 100 are stored inside a housing, an attacker cannot directly access the inside of the housing, so the above-mentioned form of obstruction (b), which is modification of the connection between the component devices 100, or the reliability The above-mentioned form of inhibition (c) based on input from an incapable partner no longer occurs. Therefore, in the example shown in FIG. 18, attack stages AS1-2 and AS1-3 of attack scenario AS1, attack stages AS2-2 and AS2-3 of attack scenario AS2, and attack stage AS3-1 of attack scenario AS3 correspond to The "inhibition form" is "(a)", "(b), (c)" is excluded from "(a), (b), (c)", and only "(a)" is left.

Additionally, the "attack means" is refined based on the added "component device connection form details" by re-estimation. For example, in the example shown in FIG. 18, the “attack means” of the attack scenario AS1 is detailed based on the detailed information 204. FIG. 17 is a diagram showing detailed information 204 of attack methods and occurrence events. The detailed information 204 indicates "detailed attack means" and "detailed events that may occur due to the attack" corresponding to the combination pattern of the values of the "attack means" and the items of the detailed information 203.

The "attack means" of the detailed information 204 is the attack means before being refined based on the detailed information 204. "Detailed information" indicates a pattern that includes the value of one item or a combination of values of multiple items stored in the detailed information 204 (FIG. 17). This pattern excludes "detailed information" items for which no values are stored. "Detailed attack method" is information specifically and in detail showing the attack method corresponding to the combination of "attack method" and "detailed information."

"Detailed events that may occur due to attacks" are events that may occur due to attacks that correspond to "detailed attack methods," and are information that specifically and in detail indicate each event. Note that the same "detailed attack method" and "detailed event that may occur in an attack" may correspond to different combinations of "detailed information".

Specifically, for example, the "attack method" corresponding to the attack stage AS1-1 of the attack scenario AS1 and the attack stage AS2-1 of the attack scenario AS2 is determined based on the detailed information 204 (FIG. 17). ” (a), (b), and (c), “Attack Means 4,” “Attack Means 5,” and “Attack Means 6” are “Attack Means 4-1,” “Attack Means 5-3,” and “Attack Means,” respectively. It is detailed as 6-2”. Furthermore, "events that may occur due to attacks" are detailed as "event 4-1 (3)," "event 5-3 (2)," and "event 6-2 (2)," respectively. The numbers written in parentheses next to "events that may occur due to attacks" are scores for each event that represent the degree of security risk caused to the target system due to the attack, for example, on a five-point scale from 1 to 5.

Similarly, the "attack means" corresponding to the attack stages AS1-2 and AS1-3 of the attack scenario AS1 and the attack stages AS2-2 and AS2-3 of the attack scenario AS2 are determined based on the detailed information 204 as "obstruction mode". Regarding (a), "Attack Means 4" is detailed as "Attack Means 4-2." Furthermore, "events that may occur due to attacks" are detailed as "event 4-2 (4)."

Similarly, based on the detailed information 204, the "attack method" corresponding to the attack stage AS3-1 of the attack scenario AS3 is "attack method 4" and "attack method" for each of the "obstruction modes" (a) and (b). "Means 5" are detailed as "Attack Means 4-3" and "Attack Means 5-1," respectively. Furthermore, "events that may occur due to attacks" are detailed as "event 4-3 (3)" and "event 5-1 (1)," respectively.

When step S7 ends, the attack scenario generation unit 113 returns the process to step S5.

As explained above, the user is first presented with an attack scenario expressed by attack methods roughly classified in step S3. This rough attack classification is a so-called classification without omissions or duplications, and for those who are not security experts, it is easier to verify comprehensiveness than attack scenarios expressed using specific attack methods. After that, for attack scenarios that require consideration of countermeasures, the user is required to input additional device information, and the attack scenario is repeatedly detailed and subdivided according to the user's requests. This enables a smooth transition to the process of identifying the specific technical content and selecting the necessary countermeasure technology.

According to the present embodiment, an attack predicted based on the device configuration input by the user is expressed as an attack type defined by the operational elements in the device's operational model and its inhibition form, and presented to the user as an attack scenario. do. Since the entire set of possible attack methods is defined by the operational elements and the forms of inhibition, the attack types obtained by classifying them are guaranteed to be exhaustive. Additionally, unlike known attack vectors, this classification is based on the behavior of the device, so any user familiar with the system targeted for security risk assessment will be able to grasp an overview of the attack scenario even if they are not a security expert. It has the advantage of being easy to do.

In addition, in the above description, functions and means that do not have any special mention regarding the configuration include electric circuits, electronic circuits, logic circuits, and integrated circuits incorporating them, as well as microcomputers, processors, and similar arithmetic devices. , ROM (Read Only Memory), RAM (Random Access Memory), flash memory, hard disk, SSD, memory card, optical disk and similar storage devices, buses, networks and similar communication devices, and peripheral devices. It should be noted that the present invention may be realized by programs executed in combination, and the present invention can be realized in either embodiment.

Furthermore, the present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiments have been described in detail to explain the present invention in an easy-to-understand manner, and the present invention is not necessarily limited to having all the configurations described. Furthermore, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace some of the configurations of each embodiment with other configurations.

1: Security risk assessment support system, 11: Processor, 13: Storage device, 16: Output device, 111: Device configuration information input section, 112: Attack route search section, 113: Attack scenario generation section, 114: Attack scenario presentation section , 200: Equipment configuration information, 201: Attack means correspondence information, 202: Occurrence event correspondence information, 203: Detailed information, 204: Detailed information, 205: Attack scenario information.

Claims

A security risk assessment support method executed by a security risk assessment support system, the method comprising:
a configuration information input step of accepting input of configuration information regarding a target system configured including component devices;
an attack route searching step of searching for an attack route through which an attack on the target system passes through the component devices, based on the configuration information;
Generate an attack scenario by arranging the attack paths in the order in which the attack passes through the component devices, and determine which attack type corresponds to a mode in which the operation of the component devices constituting the attack path is obstructed by the attack. an attack scenario generation step of estimating the configuration of the component device based on a functional model representing the configuration from a functional perspective and reflecting the estimated attack type in the attack scenario;
an attack scenario presentation step of presenting the attack scenario generated by the attack scenario generation step;
A security risk assessment support method comprising:
The security risk assessment support method according to claim 1, comprising:
In the configuration information input step,
A security risk assessment support method, comprising inputting the configuration information according to the functional model.
The security risk assessment support method according to claim 1, comprising:
The security risk assessment support method is characterized in that the functional model includes a type of operational element of the component device.
The security risk assessment support method according to claim 1, comprising:
In the attack scenario generation step,
A security risk assessment support method characterized by estimating a type of event that may occur in the component device based on the estimated attack type, and reflecting the estimated event type in the attack scenario.
The security risk assessment support method according to claim 4,
The security risk assessment support method is characterized in that the type of event includes a score for each type of event indicating the degree of security risk caused to the target system by the attack.
The security risk assessment support method according to claim 1, comprising:
a detailed information additional input step of accepting additional input of detailed information of the configuration information;
Based on the detailed information received in the detailed information addition input step, estimate a detailed attack method by comparing with the attack type, and generate the attack type of the attack scenario generated in the attack scenario generation step. an attack scenario detailing step of updating with the estimated detailed attack method;
A security risk assessment support method characterized by having the following.
The security risk assessment support method according to claim 6,
In the attack scenario detailing step,
A security risk assessment characterized in that, based on the detailed information, the attack type in which the operation of the component devices constituting the attack route is not applicable is excluded from the attack scenario. How to help.
The security risk assessment support method according to claim 6,
In the attack scenario detailing step,
A security risk assessment support method characterized by estimating a detailed event that may occur in the component device using the detailed attack means, and reflecting the estimated detailed event in the attack scenario.
The security risk assessment support method according to claim 8,
A security risk assessment support method, wherein the detailed event includes a score for each detailed event indicating the degree of security risk caused to the target system by the attack.
The security risk assessment support method according to claim 6,
A security risk assessment support method characterized in that the detailed information addition input step and the attack scenario detailing step are repeatedly executed until a predetermined condition is satisfied.
A security risk assessment support system that executes a security risk assessment regarding a target system including component devices, the system comprising:
a configuration information input unit that receives input of the configuration information;
an attack route search unit that searches for an attack route through which an attack on the target system passes through the component devices, based on the configuration information;
Generate an attack scenario by arranging the attack paths in the order in which the attack passes through the component devices, and determine which attack type corresponds to a mode in which the operation of the component devices constituting the attack path is obstructed by the attack. an attack scenario generation unit that estimates the configuration of the component device based on a functional model representing the configuration from a functional perspective and reflects the estimated attack type in the attack scenario;
an attack scenario presentation unit that presents the attack scenario generated by the attack scenario generation unit;
A security risk assessment support system characterized by having.
The security risk assessment support system according to claim 11,
The attack scenario generation unit includes:
A security risk assessment support system characterized by estimating a type of event that may occur in the component device based on the estimated attack type, and reflecting the estimated event type in the attack scenario.
The security risk assessment support system according to claim 11,
The configuration information input unit receives additional input of detailed information of the configuration information,
The attack scenario generation unit includes:
Based on the detailed information received by the configuration information input unit, estimate a detailed attack method by comparing with the attack type, and estimate the attack type of the attack scenario generated by the attack scenario generation unit. 1. A security risk assessment support system, characterized in that the security risk assessment support system is updated with the detailed attack method.
The security risk assessment support system according to claim 13,
The attack scenario generation unit includes:
A security risk assessment characterized in that, based on the detailed information, the attack type in which the operation of the component devices constituting the attack route is not applicable is excluded from the attack scenario. support system.
The security risk assessment support system according to claim 13,
The attack scenario generation unit includes:
A security risk assessment support system characterized by estimating a detailed event that may occur in the component device using the detailed attack means, and reflecting the estimated detailed event in the attack scenario.