WO2022059146A1 - Risk value calculation device, risk value calculation method, and risk value calculation program - Google Patents

Abstract

A risk value calculation device (10) receives inputs of a log of accesses to an information system to be analyzed and web content constituting the information system. The risk value calculation device (10) then totals the number of accesses to the information system from the access log. The risk value calculation device (10) also totals, from the details of the web content, the number of files, the number of password input forms, the number of actions, and the number of parameters included in the web content. The risk value calculation device (10) then calculates the degree of asset impact of the information system on the basis of the total number of accesses to the information system and on the basis of the number of files, the number of password input forms, the number of actions, and the number of parameters included in the web content. The risk value calculation device (10) then calculates a risk value for the information system using the degree of asset impact.

Description

Risk value calculation device, risk value calculation method, and risk value calculation program

The present invention relates to a risk value calculation device, a risk value calculation method, and a risk value calculation program.

Generally, risk is expressed as asset x vulnerability x threat, and for example, CVSS (Common Vulnerability Scoring System) is used as the risk evaluation value (hereinafter, appropriately referred to as risk value). CVSS is a quantitative index for evaluating vulnerabilities based on a unified evaluation standard, and companies often use CVSS as an index when considering security measures.

M.U. Aksu et al., "A Quantitative CVSS-Based Cyber Security Risk Assessment Methodology For IT Systems," 2017 International Carnahan Conference on Security Technology (ICCST), Madrid, 2017.

However, since CVSS is an index focusing on vulnerabilities and threats, it does not reflect the asset information of information systems and cannot accurately express the risk values of information systems. In addition, a risk assessment method that considers the asset impact of information systems has also been proposed in the prior art, but since this technology used the sum of the CVSS values of vulnerabilities possessed by information systems as the asset impact, information systems. The risk value of is not accurately expressed.

Therefore, it is an object of the present invention to solve the above-mentioned problems and accurately calculate the risk value of the information system.

In order to solve the above-mentioned problems, the present invention determines the access log to the information system to be analyzed, the input unit that accepts the input of the Web contents constituting the information system, and the number of accesses from the access log to the information system. The aggregation processing unit that aggregates and aggregates the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters from the content of the Web content, and the aggregated number of accesses to the information system. It is characterized by including an asset impact calculation unit that calculates the asset impact of the information system based on the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters.

According to the present invention, the risk value of the information system can be calculated accurately.

FIG. 1 is a diagram showing a configuration example of a risk value calculation device. FIG. 2 is a diagram showing a configuration example of the data collection unit of FIG. FIG. 3 is a flowchart showing an example of the processing procedure of the data collection unit of FIG. FIG. 4 is a diagram showing a configuration example of the asset impact calculation unit of FIG. FIG. 5 is a flowchart showing an example of the processing procedure of FIG. FIG. 6 is a flowchart showing a specific example of the process of S24 of FIG. FIG. 7 is a diagram showing a configuration example of the risk value calculation unit of FIG. FIG. 8 is a flowchart showing an example of the processing procedure of the risk value calculation unit of FIG. FIG. 9 is a diagram showing a configuration example of a computer that executes a risk value calculation program.

Hereinafter, embodiments (embodiments) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to the embodiments described below.

[Overview]
First, the outline of the risk value calculation device 10 of the present embodiment will be described with reference to FIG. The risk value calculation device 10 calculates the risk value of the information system using the Web contents of the information system to be analyzed, the access log to the information system, and the vulnerability information of the information system. In the following description, the FQDN (Fully Qualified Domain Name) of the information system corresponds to the identifier of the information system to be analyzed.

The risk value calculation device 10 includes a data collection unit 11, an asset impact calculation unit 12, and a risk value calculation unit 13. First, the data collection unit 11 acquires the Web contents constituting the information system based on the FQDN of the information system to be analyzed (S1).

Next, the asset impact calculation unit 12 calculates the asset impact of the information system by a predetermined evaluation formula using the Web content acquired by the data collection unit 11 and the access log of the information system (the asset impact calculation unit 12). S2). For example, the asset impact calculation unit 12 is based on the number of accesses obtained from the access log to the Web content, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters. Calculate the degree of asset impact of.

After that, the risk value calculation unit 13 calculates and outputs the risk value of the information system based on the asset impact degree of the information system calculated by the asset impact calculation unit 12 and the vulnerability information of the information system. (S3).

In this way, the risk value calculation device 10 calculates the degree of asset impact used for calculating the risk value of the information system, the number of accesses obtained from the access log to the Web content, the number of files included in the Web content, and the password. Use the number of input forms, the number of actions, and the number of parameters. By doing so, the risk value calculation device 10 can calculate the degree of asset impact in consideration of the magnitude of the impact on the user when an incident occurs in the information system.

[Configuration example]
Next, a configuration example of each part of the risk value calculation device 10 will be described.

[Configuration example of data collection unit]
First, a configuration example of the data collection unit 11 will be described with reference to FIG. The data collection unit 11 includes, for example, an input unit 111, an environment setting file 112, a data collection processing unit 113, and an output unit 118.

The input unit 111 accepts the input of the FQDN of the information system to be analyzed. The environment setting file 112 is a file showing setting information referred to when the data collection processing unit 113 operates.

The environment setting file 112 is, for example, a file showing the number of search layers, the threshold value of similarity, the path of a folder (working folder), and the like. The number of search layers is a value indicating to which level the links are searched when creating the link list of the Web contents of the information system. The default value of the number of search layers is, for example, "3". The similarity threshold is a threshold used when grouping links that are similar to each other. The default value of this similarity threshold is, for example, "0.95". The folder path is the path of the working folder that stores the result (Web content) after the data collection process. The environment setting file 112 is stored, for example, in a storage unit (not shown) of the risk value calculation device 10.

The data collection processing unit 113 collects Web contents constituting the information system from the information system based on the input FQDN of the information system to be analyzed. The data collection processing unit 113 includes, for example, a collection unit 114, a communication control unit 115, an analysis unit 116, and an evaluation unit 117.

The collection unit 114 acquires Web content from the information system to be analyzed through the communication control unit 115. The communication control unit 115 communicates with other devices by, for example, the HTTP protocol. The collection unit 114 stores the Web content acquired from the information system to be analyzed (hereinafter, appropriately referred to as the analysis target system) through the communication control unit 115 in the storage unit (not shown). Further, the collection unit 114 stores the links accessed through the communication control unit 115 among the link destinations of the Web contents in the storage unit (not shown).

The analysis unit 116 analyzes the Web content acquired by the collection unit 114. For example, the analysis unit 116 detects the a tag in the page of the Web content acquired by the collection unit 114, extracts the href value (page link), and creates a linked list.

The evaluation unit 117 selects the link list created by the analysis unit 116. For example, the evaluation unit 117 performs the following processing on the link described in the link list.

-The evaluation unit 117 deletes the link that has already been accessed.
-The evaluation unit 117 takes out two from the link list and calculates the similarity between the links using the FQDN of the link as a character string. For example, the Levenshtein distance is used to calculate the similarity. When the calculated similarity between the links is equal to or greater than the threshold value, the evaluation unit 117 deletes one of the links. The evaluation unit 117 performs the above processing for all combinations of links.
-In addition, the evaluation unit 117 calculates the degree of similarity between the accessed link and the link in the link list, and deletes the link if the degree of similarity is equal to or higher than the threshold value in the link list.

The link list selected by the evaluation unit 117 is passed to the communication control unit 115. Then, the communication control unit 115 acquires the Web content corresponding to the link in the link list. The collection unit 114 stores the Web content acquired from the analysis target system through the communication control unit 115 in the storage unit (not shown). Further, the collection unit 114 stores the links accessed through the communication control unit 115 among the link destinations of the Web contents in the storage unit (not shown).

Then, for the Web content acquired from the analysis target system, the analysis unit 116 and the evaluation unit 117 are processed, a new linked list is created, and the above processing is repeated. The number of repetitions here is the number of search layers (for example, 3) shown in the environment setting file 112.

After the above repetitive processing is completed, the output unit 118 outputs the Web content for each FQDN processed by the data collection processing unit 113. For example, the output unit 118 outputs the Web content for each FQDN processed by the data collection processing unit 113 to the working folder shown in the environment setting file 112.

[Example of processing procedure of data collection unit]
Next, an example of the processing procedure of the data collection unit 11 will be described with reference to FIG. First, the input unit 111 of the data collection unit 11 reads the FQDN of the analysis target system (S11). The collection unit 114 acquires the Web content of the analysis target system based on the FQDN read in S11 (S12). Next, the analysis unit 116 analyzes the Web content acquired in S12 and creates a linked list (S13). Then, the evaluation unit 117 selects the links in the link list by deleting the links similar to each other, deleting the links similar to the accessed links, etc. among the links included in the link list created in S13. (S14: Select the link list).

After S14, the collecting unit 114 acquires the Web content corresponding to the link in the link list (S15), and determines whether or not the Web content of the link having a predetermined number of search layers has been acquired (S16). Here, when the collecting unit 114 determines that the Web content of the link having a predetermined number of search layers has been acquired (Yes in S16), the process proceeds to S17. Then, the output unit 118 outputs the Web content for each FQDN acquired by the collection unit 114 (S17).

On the other hand, if the collecting unit 114 determines that the Web content of the link having a predetermined number of search layers has not been acquired yet (No in S16), the process returns to S13.

By doing so, the data collection unit 11 can acquire the Web content traced to a predetermined number of layers of the Web content of the analysis target system.

[Structure example of asset impact calculation unit]
Next, a configuration example of the asset impact calculation unit 12 will be described with reference to FIG. The asset impact calculation unit 12 includes, for example, an input unit 121, an environment setting file 122, an asset impact calculation processing unit 123, and an output unit 127.

The input unit 121 receives the access log of the analysis target system and the input of the FQDN and the Web content output from the data collection unit 11.

The environment setting file 122 is a file showing the setting information referred to when the asset impact calculation processing unit 123 operates. The environment setting file 122 is, for example, a file showing a list of file extensions to be excluded from the asset impact calculation process, a folder (working folder) path for storing the result of the asset impact calculation process, and the like. Is. The file extensions that are excluded from the asset impact calculation process are, for example, .css, .jpg, .png, .js, and the like. The environment setting file 122 is stored, for example, in a storage unit (not shown) of the risk value calculation device 10.

The asset impact calculation processing unit 123 calculates the asset impact of the analysis target system based on the access log of the analysis target system and the Web contents of the analysis target system. The asset impact calculation unit 12 includes an aggregation unit 124, an analysis unit 125, and an evaluation unit 126.

The totaling unit 124 counts the number of Web content files (A) received by the input unit 121. Further, the aggregation unit 124 counts the number of IP addresses (B) excluding duplicates from the access destination IP addresses shown in the access log received by the input unit 121.

The analysis unit 125 counts the number of parameters included in a predetermined file among the Web content files received by the input unit 121.

For example, the analysis unit 125 has an extension (for example, .css, .jpg, .png, .js, etc.) whose file extension is shown in the environment setting file 122 among the Web content files received by the input unit 121. For files that are not, count the number of parameters included in the file. The parameters to be counted by the analysis unit 125 are, for example, password, name, id, action attribute and the like. As a result, the analysis unit 125 can count the number of password input forms, the number of actions, the number of parameters such as name and id included in the target file.

A specific example of counting the number of parameters above is given. For example, when the form tag exists in the target file, the analysis unit 125 counts the number of times (C) that type = “password” exists in the form tag. If the form tag exists in the target file and the name tag or id tag exists in the form tag, the analysis unit 125 counts the number of times (D) that the name tag or id tag exists. However, if the target name tag or id tag has already been counted, the analysis unit 125 does not count the tag.

If the input tag exists in the target file, the analysis unit 125 counts the number of times (D) that the name tag or id tag exists in the input tag. However, if the target name tag or id tag has already been counted, the analysis unit 125 does not count the tag. Further, if the form tag and the input tag exist in the target file, but neither the name tag nor the id tag exists in the tag and the action attribute exists, the analysis unit 125 determines the number of times the action attribute exists (D). To count.

[Evaluation Department]
The evaluation unit 126 calculates the asset impact degree of the analysis target system using the values obtained by the aggregation unit 124 and the analysis unit 125. For example, the evaluation unit 126 is based on the number of accesses to the analysis target system obtained by the aggregation unit 124 and the analysis unit 125, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters. , Calculate the asset impact of the system to be analyzed.

For example, the following values A to D are obtained for each FQDN by the processing of the aggregation unit 124 and the analysis unit 125.

A. Number of Web content files B. Number of IP addresses excluding duplicates (number of accesses)
C. Number of password input forms D. Number of parameters in the web content

Further, the degree of influence S on the website w _i (i = 1,2, ..., N) can be obtained by the following equation (1). In addition, α (w _i ) in the equation (1) is a value corresponding to the availability of the website w _i , and β (w _i ) is a value corresponding to the confidentiality of the website w _i , and γ ( w _i ) is the value corresponding to the completeness of the website w _i .

Therefore, the evaluation unit 126 calculates α (w _i ), β (w _i ), and γ ( _wi ) in the equation (1) using the above values A to D to obtain the analysis target system. The degree of asset impact can be calculated. In addition, α (w _i ), β (w _i ), and γ (w _i ) are values between 0 and 1, respectively.

[About α (w _i )]
The calculation of the value of α (w _i ) (value corresponding to availability) will be described. It is considered that the greater the number of accesses to the analysis target system (Web site), the greater the impact on the user when a system incident occurs. Therefore, when the evaluation unit 126 calculates the above α ( _wi ) (value corresponding to availability), the number of access to the website (B above) is used.

For example, the evaluation unit 126 sets the maximum value of the number of accesses (B above) obtained for each FQDN as the base of the logarithm, and sets the number of accesses of each FQDN as the antilogarithm, thereby setting α (w _i ) above. Calculate (see equation (2)). By setting the maximum value of the number of accesses to the bottom of the log, the influence of the singular value of the number of accesses can be mitigated.

The α (w _i ) calculated by the above equation (2) becomes larger as the number of uses (accesses) of the website w _i increases.

[About β (w _i )]
Next, the calculation of the β (w _i ) value (value corresponding to confidentiality) will be described. If the system to be analyzed (website) has confidential information, it will be equipped with appropriate authentication or authorization function using a login form. Furthermore, since the large number of uses (accesses) is directly linked to the amount of confidential information, it is considered that the impact on users when a system incident occurs is large. Therefore, when the evaluation unit 126 calculates the above β ( _wi ), the number of password input forms (above C) and the number of accesses (above B) are used.

For example, the evaluation unit 126 sets the value with the largest number of accesses as the base of the logarithm among the FQDNs in which the number of password input forms (C above)> 0, and sets the number of accesses of each FQDN as the antilogarithm. Then, the above β ( _wi ) is calculated (see equation (3)). In the above equation (3), β regarding the FQDN in which the number of password input forms = 0 is set to 0.

The β (w _i ) calculated by the above equation (3) becomes larger as the website w _i has a password input form (login form) and the number of uses (accesses) increases.

[About γ (w _i )]
Next, the calculation of the value of γ (w _i ) (the value corresponding to the integrity) will be described. If the analysis target system (Web site) has a function to accept input from the user (for example, the part where the input tag and form tag are set), there is a high possibility that the function will be abused and falsification will occur. Conceivable. Therefore, it is considered that the larger the number of functions that can be abused (number of actions, the number of parameters) and the number of targets that can be tampered with (the number of contents), the greater the impact when an incident occurs in the system. Therefore, when the evaluation unit 126 calculates the above γ ( _wi ) (value corresponding to the integrity), the number of contents (corresponding to the “number of files” shown in A above) and the number of accesses (the above). B) and the number of parameters (D above) are used.

For example, the evaluation unit 126 calculates a value (first value) with the largest value among the number of Web content files of each FQDN as the base of the logarithm and the number of Web content files of each FQDN as the true number. do. Further, the evaluation unit 126 calculates a value (second value) in which the largest value among the number of parameters in the Web content in each FQDN is the base of the logarithm and the number of parameters in each FQDN is the true number. do. Then, the evaluation unit 126 sets the value obtained by dividing the sum of the first value and the second value by 2 as the above γ ( _wi ) (see equation (4)).

The γ (w _i ) calculated by the above equation (4) becomes a larger value as the number of contents, the number of actions, and the number of parameters of the website w _i increase. The number of actions and the number of parameters of the Web content can be obtained by the evaluation unit 126 confirming the number of form tags (action attribute) and input tags (name attribute) of the Web content.

Then, the evaluation unit 126 calculates the asset impact degree by substituting the calculated α (w _i ), β (w _i ) and γ (w _i ) into the equation (1) for each FQDN.

The output unit 127 outputs the asset impact degree for each FQDN calculated by the evaluation unit 126. For example, the output unit 127 stores the asset impact degree for each FQDN calculated by the evaluation unit 126 in a predetermined working folder.

Note that the above evaluation unit 126 may perform ranking based on the high degree of asset impact obtained for each FQDN, and may give a score of asset impact according to the result of the ranking. In that case, the output unit 127 outputs the score of the asset impact degree for each FQDN given by the evaluation unit 126.

[Example of processing procedure of asset impact calculation unit]
Next, an example of the processing procedure of the asset impact calculation unit 12 will be described with reference to FIG. First, the input unit 121 of the asset impact calculation unit 12 acquires the Web content output from the data collection unit 11 and the access log of the analysis target system (S21: Acquires the Web content and the access log).

Next, the aggregation unit 124 counts the number of Web content files acquired in S21 (S22). Further, the aggregation unit 124 counts the number of IP addresses (access counts) excluding duplicates from the access log acquired in S21 (S23).

After S23, the analysis unit 125 scans the inside of the predetermined file of the Web content acquired in S21 and counts the number of parameters in the file (S24). For example, the analysis unit 125 counts the number of password input forms, the number of actions, the number of parameters such as name and id included in the target file. Details of the processing of S24 will be described later using a specific example.

After S24, the evaluation unit 126 determines the number of Web content files acquired in S21, the number of accesses to the analysis target system, the number of password input forms counted in S24, the number of actions, the number of parameters such as name and id. The degree of asset impact is calculated using (S25). The asset impact calculation processing unit 123 executes the above-mentioned processes S21 to S25 for each FDQN. After that, the output unit 127 outputs the asset impact degree calculated for each FQDN (S26).

Next, a specific example of the process of S24 in FIG. 5 will be described with reference to FIG.

For example, when the analysis unit 125 determines whether or not the form tag exists in the Web content file acquired in S21 of FIG. 4 (S241) and determines that the form tag exists in the file (Yes in S241). ), Count the number of times type = “password” exists in the form tag (S242). Further, the analysis unit 125 counts the number of times that the name tag or id tag exists in the form tag (S243). After that, the analysis unit 125 determines whether or not the input tag exists in the file (S244). Here, when the analysis unit 125 determines that the input tag exists in the file (Yes in S244), the number of times the name tag or id tag exists in the input tag of the file is counted (S245). Then, proceed to S246.

If the analysis unit 125 determines in S241 that the form tag does not exist in the file (No in S241), it skips S242 and S243 and proceeds to S244. If the analysis unit 125 determines in S244 that the input tag does not exist in the file (No in S244), it skips S245 and proceeds to S246.

In S246, when the analysis unit 125 determines that the file has a form tag and an input tag, but there is neither a name tag nor an id tag in the tag (Yes in S246), the action attribute in the tag Count the number (S247). Then, the process is terminated.

On the other hand, when the analysis unit 125 determines that neither the form tag nor the input tag exists in the file (No in S246), the process of S247 is not executed and the process ends.

By the above processing, the analysis unit 125 counts the number of password input forms, the number of actions, the number of parameters such as name and id included in the target file.

[Risk value calculation unit]
Next, a configuration example of the risk value calculation unit 13 will be described with reference to FIG. 7. The risk value calculation unit 13 includes, for example, an input unit 131, an environment setting file 132, a risk value calculation processing unit 133, and an output unit 136.

The input unit 131 receives the asset impact degree (for example, the asset impact score) for each FQDN output from the asset impact calculation unit 12. Further, the input unit 131 accepts the input of vulnerability information. This vulnerability information is, for example, vulnerability information based on CVSS v3.

The environment setting file 132 is a file showing the setting information referred to when the risk value calculation processing unit 133 operates. The environment setting file 132 is, for example, a file showing the path of a folder (working folder) for storing the result of the calculation process of the risk value calculation process unit 133. The environment setting file 132 is stored, for example, in a storage unit (not shown) of the risk value calculation device 10.

The risk value calculation processing unit 133 calculates the risk value of the analysis target system. For example, the risk value calculation processing unit 133 has a risk value for each FQDN (for example, a risk score) based on the asset impact score for each FQDN output from the asset impact calculation unit 12 and the above vulnerability information. ) Is calculated.

The risk value calculation processing unit 133 includes an aggregation unit 134 and an evaluation unit 135. From the above vulnerability information, the aggregation unit 134 acquires a value (C) indicating an impact on confidentiality, a value (I) indicating an impact on integrity, and a value (A) indicating an impact on availability. In addition, the aggregation unit 134 acquires the attack easiness value from the vulnerability information.

The evaluation unit 135 calculates the risk value of the analysis target system using the asset impact value of the analysis target system calculated by the asset impact calculation unit 12. For example, the evaluation unit 135 calculates the CVSS value (risk value) based on the asset impact value based on the Environmental Metrics of CVSSv3 for each vulnerability possessed by the analysis target system.

An example of calculating the risk value by the evaluation unit 135 will be explained. For example, first, the evaluation unit 135 uses α, β, and γ used to calculate the asset impact degree, and uses the following equation (5) to determine the security requirement (CR, IR, AR) of the analysis target system. Calculate the called value. That is, the evaluation unit 135 calculates the value obtained by adding the above-mentioned C, R or I influence degree (β, γ or α) to the asset influence degree as the security requirement degree (CR, IR, AR) of the analysis target system. do. CR is a value indicating the security requirement level regarding confidentiality, IR is a value indicating the security requirement level regarding integrity, and AR is a value indicating the security requirement level regarding availability.

Next, the evaluation unit 135 uses the above C, I, A and the CR, IR, and AR calculated by the above equation (5), and the influence of the analysis target system by the following equation (6). Calculate the degree.

After that, the evaluation unit 135 calculates the CVSS value (risk value) by the following formula (7) using the above attack easiness and the influence degree calculated by the above formula (6). In addition, RoundUp1 in the equation (7) indicates rounding up to the first decimal place.

The evaluation unit 135 performs the above risk value calculation process for all the vulnerabilities possessed by the analysis target system. As a result, the evaluation unit 135 can obtain risk values for all the vulnerabilities possessed by the analysis target system.

The output unit 136 outputs the risk value for each FQDN calculated by the evaluation unit 135. For example, the output unit 136 stores the risk value for each FQDN calculated by the evaluation unit 135 in a predetermined working folder.

[Example of processing procedure of risk value calculation unit]
Next, an example of the processing procedure of the risk value calculation unit 13 will be described with reference to FIG. For example, the input unit 131 of the risk value calculation unit 13 acquires the asset impact score and vulnerability information for each FQDN (S31). Next, the aggregation unit 134 uses the vulnerability information acquired in S31 to indicate a value indicating the effect on confidentiality (C), a value indicating the effect on integrity (I), and a value indicating the effect on availability (A). ), And the value of attack susceptibility is acquired (S32).

After S32, the evaluation unit 135 calculates the CVSS value (risk score) from the asset impact score based on the Environmental Metrics of CVSSv3 for each vulnerability possessed by the analysis target system (S33). For example, the evaluation unit 135 has a score of the degree of asset impact for each FQDN acquired in S31, a value (C) indicating the effect on confidentiality, and a value (I) indicating the effect on integrity, acquired in S32. The CVSS value (risk score) for each FQDN is calculated using the above equations (5) to (7) using the value (A) indicating the influence on availability and the attack susceptibility value. After S33, the output unit 136 outputs the risk score calculated for each FQDN (S34).

By doing so, the risk value calculation unit 13 can calculate the risk value of each vulnerability in consideration of the asset impact degree for each FQDN.

[Other embodiments]
From the viewpoint of ease of operation, the asset impact calculation unit 12 calculates the asset impact by a metric of the number of accesses to the analysis target system, but the present invention is not limited to this. For example, the asset impact calculation unit 12 has continuous operation time of the system to be analyzed, failure recovery time, database size, system acquisition cost, maintenance cost, number of transactions, communication size, number of servers, number of general accounts, number of administrator accounts. , Number of folders, number of files, number of files limited to administrators, number of links with other systems, number of ports used, number of protocols used, information update interval, number of credit card information, number of charts, number of patents, etc. It may be used as a metric to calculate the degree of asset impact.

[effect]
Traditionally, analysis of information system risks has required a high degree of skill from the analyst. However, according to the risk value calculation device 10 of the present embodiment, the risk value of the information system is calculated quantitatively. As a result, the risk value of the information system can be easily calculated even by a non-expert.

Also, in the past, in CVSS, a risk score was given for each vulnerability, so it was not possible to prioritize countermeasures among information systems with vulnerabilities. However, the risk value calculation device 10 of the present embodiment calculates the asset impact degree by focusing on the information system itself to be analyzed, and recalculates the risk value according to the asset impact degree. As a result, the risk value calculation device 10 can obtain a risk value that reflects the information system itself to be analyzed. This makes it easier for information system administrators to prioritize countermeasures against information system vulnerabilities.

Further, since the risk value calculation device 10 calculates the degree of asset impact of the information system to be analyzed, it is possible to quantitatively determine the superiority or inferiority between the information systems. As a result, the information system administrator can easily prioritize security measures such as which information system the new security measure device should be introduced to.

[System configuration, etc.]
Further, each component of each of the illustrated parts is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of them may be functionally or physically distributed / physically in arbitrary units according to various loads and usage conditions. Can be integrated and configured. Further, each processing function performed by each device may be realized by a CPU and a program executed by the CPU, or may be realized as hardware by wired logic.

Further, among the processes described in the above-described embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or part of it can be done automatically by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[program]
The risk value calculation device 10 described above can be implemented by installing a program as package software or online software on a desired computer. For example, by causing the information processing device to execute the above program, the information processing device can function as the risk value calculation device of each embodiment. The information processing device referred to here includes a desktop type or notebook type personal computer. In addition, information processing devices include smartphones, mobile communication terminals such as mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDAs (Personal Digital Assistants).

Further, the risk value calculation device 10 can be implemented as a server device in which the terminal device used by the user is a client and the service related to the above processing is provided to the client. In this case, the server device may be implemented as a Web server, or may be implemented as a cloud that provides services related to the above processing by outsourcing.

FIG. 9 is a diagram showing an example of a computer that executes a risk value program. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these parts is connected by a bus 1080.

The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, the display 1130.

The hard disk drive 1090 stores, for example, OS1091, application program 1092, program module 1093, and program data 1094. That is, the program that defines each process executed by the risk value calculation device 10 is implemented as a program module 1093 in which a code that can be executed by a computer is described. The program module 1093 is stored in, for example, the hard disk drive 1090. For example, the program module 1093 for executing the same processing as the functional configuration in the risk value calculation device of each embodiment is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD.

Further, the environment setting files 112, 122, 132 used in the processing of the above-described embodiment are stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1090 into the RAM 1012 and executes them as needed.

The program module 1093 and the program data 1094 are not limited to those stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Then, the program module 1093 and the program data 1094 may be read from another computer by the CPU 1020 via the network interface 1070.

10 Risk value calculation device 11 Data collection unit 12 Asset impact calculation unit 13 Risk value calculation unit 111, 121, 131 Input unit 112, 122, 132 Environment setting file 113 Data collection processing unit 114 Collection unit 115 Communication control unit 116, 125 Analysis unit 117,126,135 Evaluation unit 124,134 Aggregation unit

Claims (5)

An input unit that accepts the access log to the information system to be analyzed and the input of the Web contents that make up the information system,
An aggregation processing unit that aggregates the number of accesses to the information system from the access log and aggregates the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters from the contents of the Web content.
The asset impact degree that calculates the asset impact degree of the information system based on the aggregated number of accesses to the information system, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters. Calculation unit and
A risk value calculation device characterized by being equipped with. The asset impact calculation unit
The larger the total number of accesses to the Web content, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters, the higher the degree of asset impact of the Web content is calculated. The risk value calculation device according to claim 1. Further provided with a risk value calculation unit that calculates the risk value for each vulnerability of the information system by combining the calculated asset impact degree of the information system with the value of each vulnerability of the information system. The risk value calculation device according to claim 1, wherein the risk value calculation device is characterized. It is a risk value calculation method executed by the risk value calculation device.
The process of accepting the access log to the information system to be analyzed and the input of the Web contents constituting the information system, and
A process of totaling the number of accesses to the information system from the access log and totaling the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters from the content of the Web content.
A process of calculating the asset impact of the information system based on the aggregated number of accesses to the information system, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters.
A risk value calculation method characterized by including. The process of accepting the access log to the information system to be analyzed and the input of the Web contents constituting the information system, and
A process of totaling the number of accesses to the information system from the access log and totaling the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters from the content of the Web content.
A process of calculating the asset impact of the information system based on the aggregated number of accesses to the information system, the number of files included in the Web content, the number of password input forms, the number of actions, and the number of parameters.
A risk value calculation program characterized by having a computer execute.

Images