Patent Application
20230017839
The present invention relates to a risk analysis result display apparatus, a method, and a computer readable medium.
In recent years, threats of cyber-attacks have not been limited to the fields of ICT (Information and Communication Technology), and damages have also been occurring in the fields of control systems and IoT (Internet of Things). In the case of control systems, in particular, there have been cases where the operation of a critical infrastructure has been jeopardized, such as a case where a power system or a factory is shut down. To cope with such threats of cyber-attacks, it is important to clarify security risks present in a system, implement countermeasures thereagainst, and thereby reduce the risks.
In regard to the above-described matters, the Security Center of Information-technology Promotion Agency, Japan, has published a security risk analysis guide for control systems (Non-patent Literature 1). In Non-patent Literature 1, two different methods for analyzing a risk in a detailed manner, i.e., a method for analyzing a risk from the viewpoint of a precise assessment for each system asset and a method for analyzing a risk from the viewpoint of an assessment of an actual attack scenario from an attacker's point of view, are explained. One of the above methods is an asset-based risk analysis, and the other is a business impact-based risk analysis.
In the case of the asset-based risk analysis, a risk is assessed, for each of assets constituting a system to be protected, by using its importance (its value), a possibility of the occurrence of a conceivable threat, and a vulnerability to the threat as three assessment indices. The business impact-based risk analysis is an analysis in which an attack scenario and an attack tree are used. In the case of the business impact-based risk analysis, a risk is assessed, for a business or a service implemented by a system, by using a business damage and its level, a possibility of the occurrence of an attack tree that causes business damage, and a vulnerability to the attack as three assessment indices. Either just the asset-based risk analysis by itself or the business impact-based risk analysis by itself can provide an effective assessment result. However, they also function in a manner complementary to each other, so in some cases, these two different analyses are performed for one control system. A user works out countermeasures for protecting the security of the system based on the result of the above-described asset-based risk analysis and the result of the business impact-based risk analysis.
As a related technology, Patent Literature 1 discloses a vulnerability analysis apparatus that analyzes a vulnerability(ies) in a computer system. The vulnerability analysis apparatus disclosed in Patent Literature 1 identifies a security vulnerability(ies) present in a certain apparatus, and specifies the number of attack patterns against the identified security vulnerability(ies). The vulnerability analysis apparatus specifies display information indicating the security vulnerability according to the number of attack patterns. For example, the larger the number of attack patterns is, the larger size the display information is displayed in, or the closer the display color of the display information is made to a predetermined color (e.g., red).
In Patent Literature 1, for example, information about a vulnerability for which there are a large number of attack patterns is displayed in a large size. Alternatively, information about a vulnerability for which there are a large number of attack patterns is displayed in red. In general, a vulnerability for which there are a large number of attack patterns is considered to be a vulnerability for which the necessity for security measures is high. By referring to the display information that is displayed according to the number of attack patterns, a user can determine against which vulnerability countermeasures should be preferentially taken.
Note that vulnerabilities are newly discovered day by day. Therefore, systems are compromised more and more over time, so the probability that the systems are attacked increases. By related technologies, such as the one disclosed in Patent Literature 1, it is possible to visualize which asset(s) in the system is at risk. However, in the related technologies, there is a problem that, in the case where, for example, security risks are analyzed at regular intervals, it is difficult to recognize changes in risk, such as which asset(s) in the system a vulnerability(ies) has been occurring.
In view of the above-described circumstances, an object of the present disclosure is to provide a risk analysis result display apparatus, a risk analysis result display method, and a computer readable medium capable of enabling a user to recognize changes in risk in a system.
In order to achieve the above-described object, the present disclosure provides a risk analysis result display apparatus including: comparison means for comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period, and extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period; and output means for displaying the extracted difference for a user.
Further, the present disclosure provides a risk analysis result display apparatus including: comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period; extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period based on a result of the comparison; and displaying the extracted difference for a user.
Further, the present disclosure provides a non-transitory computer readable medium storing a program for causing a computer to perform a process of: comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period; extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period based on a result of the comparison; and displaying the extracted difference for a user.
The risk analysis result display apparatus, the risk analysis result display method, and the computer readable medium according to the present disclosure are capable of enabling a user to recognize changes in risk in a system.
Prior to giving a description of an example embodiment according to the present disclosure, an outline of the present disclosure will be described.
A risk analysis result 13 is a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period. A risk analysis result 14 is a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period. The comparison means 11 compares the risk analysis results 13 and 14, and extracts a difference between them. The output means 12 displays the difference extracted by the comparison means 11 for a user.
In the present disclosure, the output means 12 displays, for a user, a difference between risk analysis results that are obtained by assessing a risk in two assessment periods. By doing so, the user can easily recognize how the risk analysis result has changed between the first and second assessment periods, and therefore can recognize changes in the risk in the system.
A first example embodiment according to the present disclosure will be described hereinafter in detail.
Note that the asset-based risk analysis result DB 104, the business impact-based risk analysis result DB 105, the vulnerability DB 106, and the comparison result DB 107 do not necessarily have to be parts of the risk analysis result display apparatus 100 as long as they can be accessed from the risk analysis result display apparatus 100. For example, at least a part of these databases may be located in a cloud, and the risk analysis result display apparatus 100 may access the database located in the cloud through a network. Further, in these databases, data is stored in a corresponding DB, for example, in the structure of a table or a graph.
The analysis result collecting unit 101 collects risk analysis results for a system to be analyzed. The analysis result collecting unit 101 collects, for example, results of two different risk analyses using analysis methods different from each other. The risk analysis results include a result of a business impact-based risk analysis for the system to be analyzed (also referred to as a business impact-based risk analysis result) and a result of an asset-based risk analysis for the same system (also referred to as an asset-based risk analysis result).
The business impact-based risk analysis result indicates a result of an assessment of a risk that arises when an attack is made along an attack path from an entry point included in the system to be analyzed to an attack target. The attack path includes at least one attack step including an attack source (i.e., an entity or the like which makes an attack), an attack destination (i.e., an entity or the like on which the attack is made), and an attack method. The business impact-based risk analysis result includes an attack step(s) that is used when an attack is made along the attack path, and an assessment index obtained by assessing a risk to the entire attack path. The assessment index includes a threat level, a vulnerability level, a business risk level, and a risk value. Each of the threat Level, the vulnerability level, and the business risk level is assessed, for example, in three levels (i.e., classified into three levels). Each of the risk values (the risk assessment values) for each of attack steps and for the entire attack path is assessed, for example, in five levels (i.e., classified into five levels) according to the combination of the threat level, the vulnerability level, and the business risk level.
Meanwhile, the asset-based risk analysis result indicates a result of an assessment of a risk for an asset(s) constituting the system to be analyzed. The asset-based risk analysis result includes an assessment index obtained by assessing a risk that arises when an attack is made on the asset by at least one conceivable attack method. The assessment index includes a threat level, a vulnerability level, a business risk level, and a risk value. Each of the threat Level, the vulnerability level, and the business risk level is assessed, for example, in three levels (i.e., classified into three levels). The risk value is assessed, for example, in five levels (i.e., classified into five levels) according to the combination of the threat level, the vulnerability level, and the business risk level.
Note that the asset-based risk analysis and the business impact-based risk analysis do not need to be exactly the same as the asset-based risk analysis and the business impact-based risk analysis, respectively, disclosed in Non-patent Literature 1.
The analysis result collecting unit 101 collects, for each asset, vulnerability information for an attack made in the system to be analyzed.
Specifically, the analysis result collecting unit 101 collects information in regard to the vulnerability present in the asset on which the attack could be made, such as identification information of the vulnerability, information about the presence/absence of a proof-of-attack code, and information about an attack method that can be used. Note that the proof-of-attack code may be a code for checking the presence of a volatility, provided by a vendor, an attack module included in an intrusion investigation tool, or information indicating whether or not an attack method is laid open to the public. Note that the vulnerability information collected by the analysis result collecting unit 101 may be information available from information open to the public, such as information as to whether or not a user is involved in the vulnerability present in the asset on which the attack could be made. Further, the vulnerability information collected by the analysis result collecting unit 101 may be information as to whether or not vulnerable software is software installed by default.
The analysis result collecting unit 101 stores the collected business impact-based risk analysis result, the asset-based risk analysis result, and the vulnerability information in the corresponding DBs. For example, the analysis result collecting unit 101 collects, at regular intervals, a plurality of business impact-based risk analysis results and a plurality of asset-based risk analysis results that are obtained by making assessments in different periods. The analysis result collecting unit 101 stores the collected business impact-based risk analysis results in the business impact-based risk analysis result DB 105. Further, the analysis result collecting unit 101 accumulates the collected asset-based risk analysis results in the asset-based risk analysis result DB 104.
Further, the analysis result collecting unit 101 accumulates vulnerability information obtained in respective assessment periods in the vulnerability DB 106.
The analysis result comparison unit 102 acquires a plurality of risk analysis results obtained in different assessment periods from the asset-based risk analysis result DB 104. For example, the analysis result comparison unit 102 acquires a current (the latest) asset-based risk analysis result and a previous (immediately before the latest) asset-based risk analysis result from the asset-based risk analysis result DB 104. The analysis result comparison unit 102 corresponds to the comparison means 11 shown in
The analysis result comparison unit 102 compares these asset-based risk analysis results with each other, and extracts a difference between them. For example, the analysis result comparison unit 102 extracts, as the difference, a combination of an asset and an attack method that are not present in the previous asset-based risk analysis result, but are present in the current asset-based risk analysis result. The combination of the asset and the attack method extracted as the difference corresponds to a combination of an asset and an attack method that have become newly available during a period between the previous and current assessment periods.
Meanwhile, for example, regarding a combination of an asset “HostD” and an attack method “Data Theft 1”, the previous risk value is “−(Null)” and the current risk value is “1”. This combination of the asset “HostD” and the attack method “Data Theft 1” corresponds to a combination of an asset and an attack method that has become available during a period between the previous and current assessment periods. For example, the analysis result comparison unit 102 extracts, as the difference, a combination of an asset and an attack method for which the previous risk value is not present and the current risk value is present.
Further, the analysis result comparison unit 102 acquires the current and previous business impact-based risk analysis results from the business impact-based risk analysis result DB 105. The previous and current business impact-based risk analysis results correspond to the risk analysis results 13 and 14, respectively, shown in
The analysis result comparison unit 102 compares these business impact-based analysis results with each other, and extracts a difference between them. For example, the analysis result comparison unit 102 extracts, as the difference, an attack step that is not included in the previous business impact-based risk analysis result, but is included in the current business impact-based risk analysis result. The attack step extracted as the difference corresponds to an attack step that has newly appeared during a period between the previous and current assessment periods.
When the attack trees shown in
Note that it is possible to determine that the attack step A1, which branches off from an already-present attack path, is an attack step that has newly become available for the attack in the current assessment period (a new attack step) because of, for example, the discovery of a new vulnerability. In contrast, it is not possible to determine that the attack step A2, which is subsequent to the attack step A1, is an attack step in which a new vulnerability is used. For example, there is a possibility that the attack step A2 may not have been present in the attack path because, though the attack method “Code execution 3” for the HostC has already been available for the attack, the attack has not been able to be made on the HostD. In such a case, it is considered that the attack step A2 is an attack step of which the risk has become apparent as the attack step A1 became available.
In this example embodiment, the analysis result comparison unit 102 may classify attack steps extracted as differences into new attack steps (second type attack steps) and attack steps of which the risks have become apparent (first type attack steps). For example, the analysis result comparison unit 102 examines whether or not a combination of the asset at the attack destination of the attack step extracted as the difference and its attack method is present in the previous asset-based risk analysis result. When the combination of the asset at the attack destination and its attack method is present only in the current asset-based risk analysis result, and is not present in the previous asset-based risk analysis result, the analysis result comparison unit 102 determines that its attack step is a new attack step. When the combination of the asset at the attack destination and its attack method is present in both the current and previous asset-based risk analysis results, the analysis result comparison unit 102 determines that its attack step is an attack step of which the risk has become apparent.
The analysis result comparison unit 102 acquires the previous vulnerability information and the current vulnerability information from the vulnerability DB. The analysis result comparison unit 102 compares differences between these two pieces of vulnerability information, and detects information that has newly appeared in the current analysis result, such as the vulnerability of the asset, an attack method for the asset, and the presence/absence of a proof-of-attack code. The analysis result comparison unit 102 compares the vulnerability information detected in the comparison of the vulnerability information with the comparison of the business impact-based risk analysis results and with the attack steps detected in the asset-based risk analysis results.
“Proof-of-Attack Code” indicates whether or not there is a proof-of-attack code, and “Used Attack Method” indicates for which attack method the vulnerability can be used. “Last Time” indicates whether or not a combination of an asset and a vulnerability is included in the previous risk analysis result, and “This Time” indicates whether or not the combination of the asset and the vulnerability is included in the previous risk analysis result. As shown in
Note that, in the above description, the analysis result comparison unit 102 compares the current asset-based risk analysis result with the previous asset-based risk analysis result, and compares the current business impact-based risk analysis result with the previous business impact-based risk analysis result. This example embodiment is not limited to the above-described example. The analysis result comparison unit 102 may compare an asset-based risk analysis result and a business impact-based risk analysis result obtained at an arbitrary time point in the past with an asset-based risk analysis result and a business impact-based risk analysis result, respectively, obtained at an arbitrary time point different from the aforementioned time point. The same applies to the comparison for the vulnerability DB.
The analysis result comparison unit 102 stores the comparison results of the business impact-based risk analysis results, those of the asset-based risk analysis results, and those of the vulnerability information in the comparison result DB 107.
The result display unit 103 visualizes the comparison results of the business impact-based risk analysis results, those of the asset-based risk analysis results, and those of the vulnerability information for a user. For example, the result display unit 103 displays comparison results stored in the comparison result DB 107 on a display device or the like (not shown in the drawings). The result display unit 103 displays the comparison results in the form of a graph or a table for a user. The result display unit 103 corresponds to the output means 12 shown in
Each of
When the attack trees shown in
The result display unit 103 may display the attack step A3 together with the vulnerability “CVE-XXXX-0003” used in the new attack step. The result display unit 103 may also display the attack step A3 together with information about the vulnerability, such as the presence/absence of a proof-of-attack code and/or information as to whether or not a user is involved. Similarly, the result display unit 103 may display the attack step A4, which is the manifested attack step, together with information about the vulnerabilities used in the attack step. Further, the result display unit 103 may also display the attack step A4 together with information about the vulnerability, such as the presence/absence of a proof-of-attack code and/or information as to whether or not a user is involved.
Each of
The result display unit 103 adds, for example, an item representing a “Newly Appearing Step” in the table showing the business impact-based risk analysis result. The “Newly Appearing Step” indicates that the attack step is a new attack step or a manifested attack step. For example, when an attack step identified by an item number is a new attack step, the result display unit 103 displays the cell (its background color) in red. When an attack step identified by an item number is a manifested attack step, the result display unit 103 displays the cell in blue. The result display unit 103 may display the entire row (each cell in the row) identified by an item number in red or in blue. The result display unit 103 may display information about the vulnerability used in the attack step in the column “Newly Appearing Step”.
For example, assume that, in
Each of
Each of
In the example shown in
As described above, by changing the display color of new attack steps from that of manifested attack steps, the user can easily determine whether or not the attack step is an attack step that has newly become available for the attack, or whether or not the attack step is an attack step of which the risk has become apparent as a new attack step has appeared. Further, by displaying vulnerabilities used in new attack steps and manifested attack steps while associating them with the new attack steps and the manifested attack steps, the user can determine against which vulnerability(ies) countermeasures should be taken.
Note that although an example in which the result display unit 103 displays (i.e., adds) a new attack step(s) and a manifested attack step(s) in a business impact-based risk analysis result has been described in the above description, this example embodiment is not limited to such examples. The result display unit 103 may display (i.e., add) a new attack step(s) and a manifested attack step(s) in an asset-based risk analysis result.
For example, assume that, in the comparison between business impact-based risk analysis results, it has been determined that the attack step of which the attack destination is a “Business Terminal” and the attack method is an “Code execution 1” is a new attack step. In this case, the result display unit 103 makes the background color of each cell in the row of the item number “1” corresponding to the combination of the target asset “Business Terminal” and “Attack Method” red. Further, assume that, in the comparison between business impact-based risk analysis results, it has been determined that the attack step of which the attack destination is a “Server” and the attack method is “FTP” is a manifested attack step. In this case, the result display unit 103 makes the background color of each cell in the row of the item number “1” corresponding to the combination of the target asset “Server” and the attack method “FTP” blue. By doing so, the user can identify the combinations of the assets and the attack methods corresponding to the new attack step and the manifested attack step in the asset-based risk analysis result.
An operation procedure (a risk analysis result display method) performed by the risk analysis result display apparatus 100 according to this example embodiment will be described hereinafter.
The analysis result comparison unit 102 acquires, for example, the previous asset-based risk analysis result and the current asset-based risk analysis result from the asset-based risk analysis result DB 104. The analysis result comparison unit 102 compares these analysis results with each other (Step S102). As a result of the comparison, the analysis result comparison unit 102 extracts a difference between the previous and current asset-based risk analysis results.
The analysis result comparison unit 102 acquires the previous business impact-based risk analysis result and the current business impact-based risk analysis result from the business impact-based risk analysis result DB 105, and compares these analysis results with each other (Step S103). As a result of the comparison, the analysis result comparison unit 102 extracts an attack step(s) that has newly appeared in the current business impact-based risk analysis result.
The analysis result comparison unit 102 classifies the above-described newly-appearing attack steps into attack steps that have become available by using a new vulnerability(ies) and attack steps that have become available by using a known vulnerability(ies). This classification can be performed by using the asset-based risk analysis results when the business impact-based risk analysis results do not include a risk value for each attack step (see the example shown in
The analysis result comparison unit 102 compares the differences of the previous vulnerability information and the current vulnerability information (Step S104). For example, the analysis result comparison unit 102 compares assets, vulnerabilities that can be used for the attack on the assets, the presence/absence of proof-of-attack codes, and attack methods that can be used for the attack of the previous analysis result with those of the current analysis result. In the step S104, the analysis result comparison unit 102 detects that, for example, a vulnerability “CVE-XXXX-0001” for an asset “HostD” has newly appeared in the example shown in
The analysis result comparison unit 102 stores the comparison result of the business impact-based risk analysis, that of the asset-based risk analysis, and that of the vulnerability information in the comparison result DB 107. The analysis result comparison unit 102 may store the asset-based risk analysis result, the business impact-based risk analysis result, and the vulnerability information used in the comparison performed in the steps S102 to S104 in the comparison result DB 107.
The result display unit 103 displays a comparison result(s) stored in the comparison result DB 107 on a display device or the like (not shown in the drawings) (Step S105). For example, the result display unit 103 can display, for a user, the comparison result in the form of a graph or a table. For example, the result display unit 103 may graphically display a new attack step(s) and a manifested attack step(s) in an attack tree as shown in
In this example embodiment, the analysis result comparison unit 102 compares two risk analysis results of which assessment periods differ from each other. For example, the analysis result comparison unit 102 compares the previous and current business impact-based risk analysis results with each other, and extracts an attack step(s) that has become newly available for the attack. The result display unit 103 presents (i.e., shows), for the user, the difference which is extracted as a result of the comparison. By doing so, the user can easily recognize a difference(s) between the two risk analysis results. For example, the user can easily recognize an attack step(s) that has newly become available for the attack. Therefore, the user can easily recognize changes in the risk, such as which asset(s) in the system a vulnerability(ies) has been occurring, and thereby easily work out security measures.
Note that when an assessment index is added to the entire attack path in the business impact-based risk analysis result, it is not possible to identify (i.e., determine) whether or not an attack step that has newly become available is an attack step in which a new vulnerability is used or an attack step in which a known vulnerability is used. In this example embodiment, the analysis result comparison unit 102 identifies (i.e., determines), by using the asset-based risk analysis result, whether or not an attack step that has newly become available is an attack step in which a new vulnerability is used or an attack step in which a known vulnerability is used. By doing so, the user can identify, among attack steps that have newly become available for the attack, a new attack step that has become available for the attack as a new vulnerability is found. Further, the user can identify a manifested attack step which has become available for the attack as a new attack step has appeared, and in which a known vulnerability is used. The user may, for example, make an assessment(s) only for a new attack step(s), thus making it possible to improve the efficiency of the assessment.
Next, a second example embodiment according to the present disclosure will be described. A configuration of a risk analysis result display apparatus according to this example embodiment may be similar to that of the risk analysis result display apparatus described in the first example embodiment shown in
The analysis result comparison unit 102 acquires the previous asset-based risk analysis result and the current asset-based risk analysis result from the asset-based risk analysis result DB 104. The analysis result comparison unit 102 compares assessment indices in these asset-based risk analysis result with each other. For example, the analysis result comparison unit 102 compares, for each combination of an asset and an attack method, “risk values” with each other. The analysis result comparison unit 102 extracts, for example, an attack method(s) for which the difference between assessment values is larger than or equal to a threshold. For example, the threshold is set in advance by a user. The analysis result comparison unit 102 may, for example, compare the previous assessment value with the current assessment value for a combination of an asset and an attack method corresponding to an attack step that is assessed in the business impact-based risk analysis result.
In result of the comparison between the asset-based risk analysis results shown in
The result display unit 103 displays the comparison result of the analysis result comparison unit 102. For example, the result display unit 103 may display an attack step(s) of which the assessment value has significantly changed in the attack tree as an attack step(s) of which the risk has increased.
The result display unit 103 may display the attack step A5 together with vulnerability information used in the attack step A5. Further, when an attack step of which the risk has increased is specified based on the “threat level”, the result display unit 103 may display how the threat level of the current result changed from that of the previous result. For example, the result display unit 103 may display “Threat Level: 1->3” in association with the attack step A5. In such a case, the user can recognize that the threat level of that attack step has changed from “1” to “3”.
When the threat level has changed from “1” to “3”, the result display unit 103 may, for example, specify based on what the threat level has changed (i.e., why the threat level has changed), and display the reason why the threat level has been specified. For example, assume that, for the vulnerability used in the attack step A5, there was no proof-of-attack code in the previous assessment period, but there is a proof-of-attack code in the current assessment period. In this case, the result display unit 103 may display “Proof-of-attack code for CVE-XXXX-0003 has been Found” for the attack step A5.
Note that although an example in which the result display unit 103 displays an attack step of which the risk has increased in the attack tree has been described in the above description, this example embodiment is not limited to such examples. Similarly to the example shown in
In this example embodiment, the analysis result comparison unit 102 specifies a combination of an asset and an attack method of which the risk has increased. Further, in this example embodiment, an attack step(s) of which the risk has increased is displayed in the attack tree. By doing so, the user can specify a part(s) for which countermeasures should be preferentially taken. Further, since an attack step of which the risk has increased is specified, the user can, for example, strengthen security measures in an attack step preceding the attack step of which the risk has increased.
Next, a third example embodiment according to the present disclosure will be described. A configuration of a risk analysis result display apparatus according to this example embodiment may be similar to that of the risk analysis result display apparatus 100 shown in
In this example embodiment, the result display unit 103 displays a combination of a table, a graph, or the like of a comparison result in the first example embodiment and that of a comparison result in the second example embodiment. Each of
The analysis result comparison unit 102 extracts an attack step A8 that is present in both the attack trees shown in
The result display unit 103 displays an arrow indicating the attack step A6, which is a new attack step, in red, and an arrow indicating the attack step A7, which is a manifested attack step, in blue. Further, the result display unit 103 displays an arrow indicating the attack step A8, of which the risk has increased, in green. The result display unit 103 may display vulnerability information used in the attack step A6. Further, regarding the attack step A8, the result display unit 103 may also display the reason why the risk has increased, and how the risk has changed.
In this example embodiment, the result display unit 103 displays a new attack step(s), a manifested attack step(s), and an attack step(s) of which the risk has increased. For example, the result display unit 103 displays a new attack step(s), a manifested attack step(s), and an attack step(s) of which the risk has increased in display modes different from one another. By doing so, it is possible to obtain the effects obtained in the second example embodiment as well as those obtained in the first example embodiment, so that a user can efficiently make an assessment.
Next, a fourth example embodiment according to the present disclosure will be described.
Results of countermeasures taken according to risk analysis results are input to the countermeasure result input unit 108. For example, when a user takes security measures against a given attack step, the countermeasure result input unit 108 stores the contents (i.e., details) of the security measures in the countermeasure result DB 109 while associating them with the attack step.
Alternatively, when the user did not take any security measures against a given attack step even though it was necessary to take security measures thereagainst, the countermeasure result input unit 108 stores, for example, the reason why no security measure was taken in the countermeasure result DB 109 while associating the reason with the attack step.
By referring to (i.e., seeing) the display screen, the user can recognize that no countermeasure has been taken for the attack step “HostD-[Code execution 3]-HostC” because countermeasures were already taken in the HostB preceding the HostD in the previous security measures. Meanwhile, in the current risk analysis result shown in
Note that although an example in which when a user selects an attack step, the contents (i.e., details) of countermeasure are displayed has been described in the above description, this example embodiment is not limited to such examples. Information about the contents of countermeasures and the like may be displayed in the asset-based risk analysis result or in the business impact-based risk analysis result. Each of
The result display unit 103 acquires contents of past countermeasures or the like for each attack step from the countermeasure result DB 109, and enters (i.e., adds) the acquired contents of countermeasures in the column “Past Countermeasure”. For example, the result display unit 103 writes (i.e., adds), for the attack step in the item number “4”, contents of countermeasures “Operationally Required” acquired from the countermeasure result DB 109 in the cell for the past countermeasures. Further, for the attack step in the item number “5,” the result display unit 103 writes (i.e., adds) contents of countermeasures “Give Training” acquired from the countermeasure result DB 109 in the cell for the past countermeasures.
In this example embodiment, contents of past countermeasures are displayed. In the displayed risk analysis result, the user can obtain details of past countermeasures against an attack step(s), and use the obtained past countermeasures for the planning of security measures that should be taken in the future. The other effects are similar to those in the first, second or third example embodiment.
Next, a physical configuration of a risk analysis result display apparatus is described.
The communication IF 550 is an interface for connecting the computer apparatus 500 to a communication network through wired communication means or wireless communication means or the like. The user IF 560 includes, for example, a display unit such as a display device. Further, the user IF 560 includes an input unit such as a keyboard, a mouse, and a touch panel.
The storage unit 520 is an auxiliary storage device that can hold various types of data. The storage unit 520 does not necessarily have to be a part of the computer apparatus 500, but may be an external storage device, or a cloud storage connected to the computer apparatus 500 through a network. The storage unit 520 can be used as, for example, at least one of the asset-based risk analysis result DB 104, the business impact-based risk analysis result DB 105, the vulnerability DB 106, and the comparison result DB 107 shown in
The ROM 530 is a non-volatile storage device. For example, a semiconductor storage device such as a flash memory having a relatively small capacity can be used for the ROM 530. A program(s) that is executed by the CPU 510 may be stored in the storage unit 520 or the ROM 530. The storage unit 520 or the ROM 530 stores, for example, various programs for implementing the function of each unit in the risk analysis result display apparatus 100.
The aforementioned program can be stored and provided to the computer apparatus 500 by using any type of non-transitory computer readable media. Non-transitory computer readable media include any type of tangible storage media. Examples of non-transitory computer readable media include magnetic storage media such as floppy disks, magnetic tapes, and hard disk drives, optical magnetic storage media such as magneto-optical disks, optical disk media such as CD (Compact Disc) and DVD (Digital Versatile Disk), and semiconductor memories such as mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, and RAM. Further, the program may be provided to a computer using any type of transitory computer readable media. Examples of transitory computer readable media include electric signals, optical signals, and electromagnetic waves. Transitory computer readable media can provide the program to a computer via a wired communication line such as electric wires and optical fibers or a radio communication line.
The RAM 540 is a volatile storage device. As the RAM 540, various types of semiconductor memory apparatuses such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory) can be used. The RAM 540 can be used as an internal buffer for temporarily storing data and the like. The CPU 510 expands (i.e., loads) a program stored in the storage unit 520 or the ROM 530 in the RAM 540, and executes the expanded (i.e., loaded) program. The function of each unit in the risk analysis result display apparatus 100 can be implemented by having the CPU 510 execute a program. The CPU 510 may include an internal buffer in which data and the like can be temporarily stored.
Although example embodiments according to the present disclosure have been described above in detail, the present disclosure is not limited to the above-described example embodiments, and the present disclosure also includes those that are obtained by making changes or modifications to the above-described example embodiments without departing from the spirit of the present disclosure.
The whole or part of the example embodiments disclosed above can be described as, but not limited to, the following Supplementary notes.
(Supplementary Note 1)
A risk analysis result display apparatus comprising:
comparison means for comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period, and extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period; and output means for displaying the extracted difference for a user.
(Supplementary Note 2)
The risk analysis result display apparatus described in Supplementary note 1, wherein
the risk analysis result includes a first risk analysis result obtained by assessing a risk that arises when an attack is made on the system to be analyzed along an attack path from an entry point included in the system to be analyzed to an attack target, the attack path including at least one attack step including an attack source, an attack destination, and an attack method, and
the comparing means extracts, as the difference, at least one attack step that is not present in the first risk analysis result in the first assessment period, but is present in the first risk analysis result in the second assessment period.
(Supplementary Note 3)
The risk analysis result display apparatus described in Supplementary note 2, wherein the output means displays, for the user, an attack step extracted as the difference in such a manner that an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period and the attack step extracted as the difference can be distinguished from each other.
(Supplementary Note 4)
The risk analysis result display apparatus described in Supplementary note 2 or 3, wherein
the risk analysis result further includes a second risk analysis result obtained by assessing a risk that arises when an attack is made on an asset in the system to be analyzed by at least one conceivable attack method,
the comparison means further classifies attack steps extracted as the difference into a first type attack step of which a combination of an asset at the attack destination and the attack method is present in both the second risk analysis result obtained in the first assessment period and the second risk analysis result obtained in the second assessment period, and a second type attack step of which a combination of an asset at the attack destination and the attack method is not present in the second risk analysis result obtained in the first assessment period but is present in the second risk analysis result obtained in the second assessment period, and
the output means displays, for the user, the attack step extracted as the difference in such a manner that the first type attack step and the second type attack step can be distinguished from each other.
(Supplementary Note 5)
The risk analysis result display apparatus described in Supplementary note 4, wherein the output means displays, for the user, a vulnerability used in the attack method in the second type attack step while associating the vulnerability with the second type attack step.
(Supplementary Note 6)
The risk analysis result display apparatus described in Supplementary note 5, wherein the output means further displays, for the user, information about the vulnerability.
(Supplementary Note 7)
The risk analysis result display apparatus described in any one of Supplementary notes 4 to 6, further comprising a countermeasure result database configured to store a security measure taken for an asset and an attack method based on the risk analysis result, wherein
the output means further displays, for the user, a security measure taken for an attack destination of the first type attack step, and an asset and an attack method corresponding to the attack destination, acquired from the countermeasure result database.
(Supplementary Note 8)
The risk analysis result display apparatus described in any one of Supplementary notes 4 to 7, wherein the output means graphically displays the attack path on a screen of a display device, and displays, in the graphically-displayed attack path, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, and the second type attack step in display modes different from one another.
(Supplementary Note 9)
The risk analysis result display apparatus described in any one of Supplementary notes 4 to 7, wherein the output means displays a table showing the first risk analysis result on a display screen of a display device, and displays, in the displayed table showing the first risk analysis result, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, and the second type attack step in display modes different from one another.
(Supplementary Note 10)
The risk analysis result display apparatus described in any one of Supplementary notes 4 to 7, wherein
the first risk analysis result includes a risk assessment for each attack step, and
the comparison means further specifies an attack step of which a risk assessment in the first risk analysis result obtained in the second assessment period changes from that in the first risk analysis result obtained in the first assessment period, and further extracts the specified attack step as the difference.
(Supplementary Note 11)
The risk analysis result display apparatus described in Supplementary note 10, wherein the output means graphically displays the attack path on a screen of a display device, and displays, in the graphically-displayed attack path, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, the second type attack step, and the attack step of which the specified risk assessment changes in display modes different from one another.
(Supplementary Note 12)
The risk analysis result display apparatus described in Supplementary note 10, wherein the output means displays a table showing the first risk analysis result on a display screen of a display device, and displays, in the displayed table showing the first risk analysis result, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, the second type attack step, and the attack step of which the specified risk assessment changes in display modes different from one another.
(Supplementary Note 13)
The risk analysis result display apparatus described in any one of Supplementary notes 4 to 7, wherein the comparison means further specifies an asset and an attack method of which a risk assessment in the second risk analysis result obtained in the second assessment period changes from that in the second risk analysis result obtained in the first assessment period, and further extracts, as the difference, an attack step in which its attack destination and its attack method are the specified asset and the specified attack method.
(Supplementary Note 14)
The risk analysis result display apparatus described in Supplementary note 13, wherein the output means graphically displays the attack path on a screen of a display device, and displays, in the graphically-displayed attack path, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, the second type attack step, and the attack step in which its attack destination and its attack method are the specified asset and the specified attack method in display modes different from one another.
(Supplementary Note 15)
The risk analysis result display apparatus described in Supplementary note 14, wherein the output means displays a table showing the first risk analysis result on a display screen of a display device, and displays, in the displayed table showing the first risk analysis result, an attack step that is present in both the first risk analysis result obtained in the first assessment period and the first risk analysis result obtained in the second assessment period, the first type attack step, the second type attack step, and the attack step in which its attack destination and its attack method are the specified asset and the specified attack method in display modes different from one another.
(Supplementary Note 16)
The risk analysis result display apparatus described in any one of Supplementary notes 1 to 7, wherein the comparison means extracts, as the difference, an entity to be assessed of which a risk assessment in the risk analysis result obtained in the second assessment period changes from that in the risk analysis result obtained in the first assessment period.
(Supplementary Note 17)
The risk analysis result display apparatus described in Supplementary note 16, wherein
the risk analysis result is a risk analysis result obtained by assessing a risk that arises when an attack is made on the system to be analyzed along an attack path from an entry point included in the system to be analyzed to an attack target, the attack path including at least one attack step including an attack source, an attack destination, and an attack method,
the risk analysis result includes a risk assessment for each attack step, and
the comparison means specifies an attack step of which the risk assessment in the risk analysis result obtained in the second assessment period changes from that in the risk analysis result obtained in the first assessment period, and extracts the specified attack step as the difference.
(Supplementary Note 18)
The risk analysis result display apparatus described in Supplementary note 16, wherein
the risk analysis result is a risk analysis result obtained by assessing a risk that arises when an attack is made on an asset in the system to be analyzed by at least one conceivable attack method, and
the comparison means specifies an asset and an attack method of which the risk assessment in the risk analysis result obtained in the second assessment period changes from that in the risk analysis result obtained in the first assessment period, and extracts the specified asset and attack method as the difference.
(Supplementary Note 19)
The risk analysis result display apparatus described in any one of Supplementary notes 16 to 18, wherein the comparison means extracts, as the difference, an entity to be assessed of which a change of an assessment value of the risk assessment in the risk analysis result obtained in the second assessment period from that in the risk analysis result obtained in the first assessment period is larger than or equal to a predetermined change.
(Supplementary Note 20)
A risk analysis result display method comprising:
comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period;
extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period based on a result of the comparison; and
displaying the extracted difference for a user.
(Supplementary Note 21)
The risk analysis result display method described in Supplementary note 20, wherein
the risk analysis result includes a first risk analysis result obtained by assessing a risk that arises when an attack is made on the system to be analyzed along an attack path from an entry point included in the system to be analyzed to an attack target, the attack path including at least one attack step including an attack source, an attack destination, and an attack method, and
in the extraction of the difference, at least one attack step that is not present in the first risk analysis result in the first assessment period but is present in the first risk analysis result in the second assessment period is extracted as the difference.
(Supplementary Note 22)
The risk analysis result display method described in Supplementary note 21, wherein
the risk analysis result further includes a second risk analysis result obtained by assessing a risk that arises when an attack is made on an asset in the system to be analyzed by at least one conceivable attack method,
the risk analysis result display method further comprises classifying attack steps extracted as the difference into a first type attack step of which a combination of an asset at the attack destination and the attack method is present in both the second risk analysis result obtained in the first assessment period and the second risk analysis result obtained in the second assessment period, and a second type attack step of which a combination of an asset at the attack destination and the attack method is not present in the second risk analysis result obtained in the first assessment period but is present in the second risk analysis result obtained in the second assessment period, and
the displaying the difference for the user comprises displaying, for the user, the attack step extracted as the difference in such a manner that the first type attack step and the second type attack step can be distinguished from each other.
(Supplementary Note 23)
A non-transitory computer readable medium storing a program for causing a computer to perform a process of:
comparing a risk analysis result obtained by assessing a risk to a system to be analyzed in a first assessment period with a risk analysis result obtained by assessing the risk to the system to be analyzed in a second assessment period different from the first assessment period;
extracting a difference between the risk analysis result obtained in the first assessment period and the risk analysis result obtained in the second assessment period based on a result of the comparison; and
displaying the extracted difference for a user.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2019/051033 | 12/25/2019 | WO |
