KR101233934B1 - Integrated Intelligent Security Management System and Method - Google Patents

Abstract

An intelligent integrated security management system and method are provided. Intelligent integrated security management method for a plurality of devices forming a communication infrastructure, using the security policy for each of the plurality of devices to check the security status of each device, analyze the results of the inspection to derive security vulnerabilities, With respect to a device from which a security vulnerability is derived from a plurality of devices, a countermeasure for the security vulnerability may be prepared, and a security vulnerability derived according to the prepared action may be compensated for.

Description

Integrated Intelligent Security Management System and Method

The present invention relates to an intelligent integrated security management system and method, and more particularly, to an intelligent integrated security management system and method that can automatically detect and compensate for security vulnerabilities of devices installed in a communication infrastructure.

With the development of e-commerce, as information technology (IT) technology is complicated and diversely complex, an environment for securing IT information is also receiving much attention. Changes in the information security environment will lead to the rapid development of information and communication networks and the increasing dependence on IT, as well as the weaknesses in the security of information and communication technology (ICT) infrastructure. However, while threats to IT infrastructures continue to increase, users' security awareness and knowledge of them do not grow together. Therefore, a security management solution is needed to automatically check and supplement security weaknesses and provide security management services for large-scale communication infrastructures such as the Internet Data Center (IDC). Do.

The present invention is not only to simply notify the security vulnerabilities found as a result of the inspection of the security state, but also intelligent security system and method that can block the security risks in advance by automatically or manually providing measures to compensate for the security vulnerabilities. The purpose is to provide.

According to an embodiment of the present invention, an intelligent integrated security management method for a plurality of devices forming a communication infrastructure may include checking a security state of each device using a security policy for each of the plurality of devices. ; Analyzing the check result to derive a security vulnerability; Providing a countermeasure against the security vulnerability of the plurality of devices from which the security vulnerability is derived; And supplementing the derived security vulnerability according to the prepared measures.

When the at least one of the plurality of devices is installed in the communication infrastructure, configuring the at least one device in a clean state based on a security policy for the at least one device; Checking the security state, checks the security state of at least one device of the clean state.

At least one device in the clean state is configured to set an operating environment.

Changing a security policy for the at least one device to conform to an operating environment of the at least one device in the clean state.

The configuring of the clean state, receiving the setting, and changing the security policy are performed while the plurality of devices are introduced into and installed in the communication infrastructure.

Deriving a security vulnerability according to the changed operating environment, if the operating environment of the at least one device is changed while at least one device of the plurality of devices is operated to provide a service.

Notifying an administrator of the derived security vulnerability; And when the administrator allows the security vulnerability, changing the security policy for at least one device whose operation environment has been changed.

If the security vulnerability is derived, the security management server automatically prepares for the security vulnerability.

When at least one of the plurality of devices is discarded in the communication infrastructure, recording the fact of discarding the at least one device in a database; And notifying an administrator that revocation of the at least one device has not been performed when the security state of the at least one device is continuously checked.

The security management server provides the security management agent with a security policy for each of the plurality of devices.

On the other hand, according to an embodiment of the present invention, there is provided a computer-readable recording medium recording a program for executing the methods on a computer.

Meanwhile, according to an embodiment of the present invention, an intelligent integrated security management system for a plurality of devices forming a communication infrastructure may check a security state of each device by using a security policy for each of the plurality of devices. A security management agent deriving a security vulnerability by analyzing the check result; And a security management server for providing a countermeasure against the security vulnerability among the devices from which the security vulnerability is derived, from the plurality of devices, wherein the security management agent is configured to perform the action according to the action provided by the security management server. It supplements the derived security vulnerability.

The security management agent, when at least one of the plurality of devices is provided in the communication infrastructure, configure the at least one device in a clean state based on a security policy for the at least one device, Check the security status of at least one device in a clean state.

When the operating environment of the at least one device in the clean state is set, the security management server changes the security policy for the at least one device to match the set operating environment.

The configuring of the at least one device to a clean state, checking the security state, and changing the security policy by the security management agent are performed while the plurality of devices are introduced into and installed in the communication infrastructure. .

While at least one of the plurality of devices is operated to provide a service, when the operating environment of the at least one device is changed, the security management agent derives a security vulnerability according to the changed operating environment.

The security management server notifies the administrator of the derived security vulnerability, and when the administrator allows the security vulnerability, changes the security policy for at least one device whose operating environment has changed.

If the security vulnerability is derived, the security management server automatically prepares for the security vulnerability.

If one of the plurality of devices is discarded in the communication infrastructure, the database for recording the fact of the discard of the one device further comprises; The security management server, the security state for the one device If constantly checked, the administrator is notified that the disposal of the one device has not been performed.

The security management server provides the security management agent with a security policy for each of the plurality of devices.

According to an embodiment of the present invention, by checking the security status based on the security policy, and automatically or manually providing measures to compensate for security vulnerabilities, the administrator saves time for security checks and poses a security risk. Can block on.

In addition, according to an embodiment of the present invention, it is possible to provide a security management process associated with an ICT infrastructure management operating processor such as ITSM (), thereby applying to a server that manages a large communication infrastructure such as IDC.

In addition, according to an embodiment of the present invention, security vulnerabilities of not only a general personal computer or a server, but also database management system (DBMS) equipment, a network device, and a security device can be automatically checked, and automatic or manual actions can be taken.

1 is a diagram illustrating an intelligent integrated security management system according to an embodiment of the present invention;
2 is a diagram illustrating a management process and a security management process of a fourth device performed according to a life cycle of a fourth device;
3 is a block diagram showing a security management server according to an embodiment of the present invention;
4 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is introduced and installed in a communication infrastructure;
5 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is operated in a communication infrastructure, and
6 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is discarded in a communication infrastructure.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features, and advantages of the present invention will become more readily apparent from the following description of preferred embodiments with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. Rather, the embodiments disclosed herein are provided so that the disclosure can be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. In this specification, when an element is referred to as being on another element, it may be directly formed on another element, or a third element may be interposed therebetween.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms "comprises" and / or "comprising" used in the specification do not exclude the presence or addition of one or more other elements.

Hereinafter, the present invention will be described in detail with reference to the drawings. In describing the specific embodiments below, various specific details have been set forth in order to explain the invention in greater detail and to assist in understanding it. However, those skilled in the art can understand that the present invention can be used without these various specific details. In some cases, it is mentioned in advance that parts of the invention which are commonly known in the description of the invention and which are not highly related to the invention are not described in order to prevent confusion in explaining the invention without cause.

1 is a diagram illustrating an intelligent integrated security management system according to an embodiment of the present invention.

The intelligent integrated security management system of FIG. 1 may manage security vulnerabilities of devices built in an information and communication technology (ICT) infrastructure by using an I ² Integrated Intelligent Security Management (SM) solution. I ² SM solution efficiently manages security vulnerabilities based on the life cycle of devices built and operated in the communication infrastructure and then discarded. In order to maintain the security clean state secured at the operation stage of the device, the security vulnerabilities may be periodically checked automatically, and actions may be automatically or manually provided to solve the security vulnerabilities.

Referring to FIG. 1, the intelligent integrated security management system includes a device management server 100, a first database (DB) 200, a security management server 300, a second DB 400, and first to third terminals. Ones 11, 12, 13 and first to fourth devices 21, 22, 23, and 24.

The first to third terminals 11, 12, and 13 are connected to the device management server 100 through a first communication network 10 to enable wired or wireless communication. The first terminal 11 may be a terminal of a customer company using an intelligent integrated security management solution. The second terminal 12 may be a terminal of an operator operating the device management server 100. The third terminal 13 may be a terminal of a security manager managing the security of the first to fourth devices 21, 22, 23, and 24. Hereinafter, operators and security managers are collectively referred to as 'managers'.

The device management server 100 may provide a web page for registering and discarding a device newly added to the communication infrastructure. To this end, the device management server 100 may be additionally installed with a web server. The device management server 100 may be, for example, IMAS.

If the administrator wants to install additional new devices (eg, the fourth device 24) in the communication infrastructure, the administrator accesses the webpage of the device management server 100 through the third terminal 13, A registration procedure for adding a device may be performed. Once the licensor authorizes registration of the new device, the new device can operate in the communication infrastructure to provide services. The licensor may be an operator.

In addition, when the administrator intends to discard a device installed in the communication infrastructure, the administrator may register the disposal of the device through a web page provided by the device management server 100. Information about registration of new devices and disposal of devices added to the communication infrastructure may be stored in the first DB 200 through the device management server 100. For this purpose, a DB server is additionally added to the device management server 100. Can be installed.

The first DB 200 may store a list of devices installed in the communication infrastructure, a list of additional registered devices, a list of discarded devices, a registration and disposal history of the device, and the like.

The security management server 300 may communicate with the first to fourth devices 21, 22, 23, and 24 installed in the communication infrastructure through the second communication network 20, and provide a management screen to the administrator. The security management server 300 may request the first to fourth agents 21a, 22a, 23a, and 24a to be described later to check the security status, prepare and provide an inspection schedule, or modify the inspection result.

The security management server 300 may prepare a security policy for each of the first to fourth devices 21, 22, 23, and 24 and provide the first to fourth agents 21a, 22a, 23a, and 24a. Can be. The security management server 300 implements various inspection methods for checking the first to fourth devices 21, 22, 23, and 24 by providing an interface linked with various security tools, and manages security vulnerabilities. It can be stored in the second DB (400) can take measures for security vulnerabilities of the first to fourth devices (21, 22, 23, 24).

The security management server 300 operating based on the ICD infrastructure life cycle will be described in detail with reference to FIG. 2 to be described later.

The second DB 400 may store a security policy for each of the first to fourth devices 21, 22, 23, and 24 installed in the communication infrastructure. Therefore, even if the first to fourth devices 21, 22, 23, and 24 are operated in the same operating system, the hardware specifications, the software specifications, or the like of the first to fourth devices 21, 22, 23, and 24 may be used. Depending on the security policy may be stored in the second DB (400). The security policy may be changed by an administrator through a management screen provided by the security management server 300.

Alternatively, a security policy may be stored in the second DB 400 according to the types of the first to fourth devices 21, 22, 23, and 24. Types of the first to fourth devices 21, 22, 23, and 24 may be classified according to types of operating systems or functions. Examples of the types of the first to fourth devices 21, 22, 23, and 24 include a server based on Linux, a server based on Unix, a server based on Windows, a server with a DBMS installed, a network and security. It is various such as the server in charge of.

The communication infrastructure is, for example, an infrastructure constructed with ICT devices constituting an organization. In FIG. 1, the first to fourth devices 21, 22, 23, and 24 belong to the communication infrastructure. The first to fourth devices 21, 22, 23, and 24 may have a life cycle including introduction and installation in a communication infrastructure, an operation phase of providing a service, and a disposal phase.

Hereinafter, the first to third devices 21, 22, and 23 of the first to fourth devices 21, 22, 23, and 24 are already installed in the communication infrastructure, and the fourth device 24 is An example of additional installation will be described.

2 is a diagram illustrating a management process and a security management process of the fourth device 24 performed according to the life cycle of the fourth device 24.

1 and 2, before or after the fourth device 24 is installed in the communication infrastructure, the administrator may access the device security management server 300 to perform a registration procedure of the fourth device 24. Can be. After the registration of the fourth device 24 is permitted, the security management agent may be installed in the fourth device 24 while the fourth device 24 is introduced and installed in the communication infrastructure.

The security management agent is a 'vulnerability Deny All policy' that automatically detects and measures security vulnerabilities of the communication infrastructure. When the fourth device 24 is introduced into the communication infrastructure, the security of the fourth device 24 is initially reviewed. By removing unnecessary exceptions, you can improve the security of your infrastructure. That is, the security management agent may apply the security criteria previously established to the fourth device 24 to remove the vulnerabilities that violate the security criteria, thereby making the fourth device 24 clean.

In detail, the security management agent is installed in all of the first to fourth devices 21, 22, 23, and 24 constituting the communication infrastructure, and thus the first to fourth devices 21, 22, 23, and 24. It may be a security program that derives security vulnerabilities by checking the security status of the system. Hereinafter, the security management agent installed in the fourth device 24 will be referred to as a 'fourth agent 24a', and the security management agent already installed in the first to third devices 21, 22 and 23 will be referred to as 'first'. To third agents 21a, 22a, and 23a '.

The administrator can install the fourth agent 24a directly on the fourth device 24. Alternatively, after the security review is completed, if it is confirmed that the operator of the device management server 100 has allowed the registration of the fourth device 24, the security management server 300 may transmit the fourth agent to the fourth device 24. By downloading 24a, the fourth device 24 can be automatically installed.

When the fourth agent 24a is provided with the security policy for the fourth device 24 from the security management server 300, the fourth agent 24a configures the fourth device 24 in a clean state based on the security policy and initializes it to a clean state. The security state of the fourth device 24 can be checked. The clean state is a result of automatically applying the security policy to the fourth device 24 in accordance with the provided security policy. In a clean state, the security vulnerability of the fourth device 24 may be intact.

After the fourth device 24 is configured to be in a clean state and the operating environment of the fourth device 24 is set, the security management server 300 controls the security policy on the fourth device 24 to match the set operating environment. Can be changed. The operating environment is an environment necessary for operating the fourth device 24 and may include, for example, a security level. The operating environment may be set by at least one of a server operator, an administrator, and a customer company, and may be set through a management screen provided by the security management server 300 by accessing the security management server 300.

If technical constraints occur when setting the operating environment, the security management server 300 classifies the generated technical constraints as a security monitoring exception, stores the classified technical constraints in the second DB 400, and the fourth agent 24a. ) Can be notified. The technical limitation is that when the security policy is automatically applied among the default settings automatically configured at the initial installation of the OS or DBMS on the fourth device 24, it is classified as a vulnerability and is automatically deleted or changed to perform work. Means necessary items. Accordingly, the fourth agent 24a does not regard the matter classified as the security monitoring exception, that is, the technical constraint as a security vulnerability.

For example, the Remote Registry service is a service that runs automatically when Windows OS is installed. When the security management agent automatically applies the security policy, it is classified as a security vulnerability used for server hacking and the service is disabled. However, in business, when the fourth device 24 should use the Windows Active Directory environment, the Remote Registry service should be run as an essential service. Therefore, in this case, the technical limitation may be a problem in which the Remote Registry service cannot be used according to the security policy. This technical limitation is that the person in charge of the security management server 300 or the person in charge of the fourth device 24 checks the security policy template on the system and checks the configuration elements necessary for the work environment running in the fourth device 24. Upon request, the security officer can register the request on the system to classify the Remote Registry service as a surveillance exception.

In addition, the security management server 300 or the fourth agent 24a may selectively apply the expiration date to the classified security monitoring exceptions. For security surveillance exceptions that do not have an expiration date, the security management server 300 is separately displayed on the management screen, whereby the administrator can check and manage security surveillance exceptions from time to time. In addition, the security management server 300 provides a search function for documents based on security surveillance exceptions, and the administrator may search and track security surveillance exceptions through the search function.

As described above, the fourth agent 24a is installed in the fourth device 24, the security criteria are automatically applied based on the security policy, and the operation of managing the security monitoring exceptions is performed by the fourth device 24. It can be performed while being introduced into and installed in the communication infrastructure.

On the other hand, if the operating environment of the fourth device 24 is set, and the security monitoring exceptions are stored in the second DB 400, the introduction and installation steps of the fourth device 24 is completed, the fourth device 24 It can be entered into the operational stage of.

In an operation stage, the fourth device 24 provides a service corresponding to the fourth device 24. When the DMBS program is installed in the fourth device 24, the fourth device 24 may provide a service for DB management.

While the service is provided, the fourth agent 24a may periodically check the security state of the fourth device 24 using the provided security policy. The fourth agent 24a may automatically report the security vulnerability to the security management server 300 when the security vulnerability is derived by analyzing the check result of the security state. A security vulnerability has a high probability of being hacked into security or a security problem. For example, if the security policy includes one administrator account for the fourth device 24, but the inspection result adds an administrator account, This can be derived as a security vulnerability.

The security vulnerability may be caused by an infection of a virus or may be caused by a change of the system of the fourth device 24. That is, if the operating environment of the fourth device 24 is changed while the fourth device 24 is operated to provide a service, the fourth agent 24a may derive a security vulnerability caused according to the operating environment. For example, when an administrator account of the fourth device 24 is added by the administrator, the operating environment of the fourth device 24 is changed, and the fourth agent 24a is added to the manager account added from the check result of the security state. Can be derived as a security vulnerability.

When the security vulnerability of the fourth device 24 is reported from the fourth agent 24a, the security management server 300 may check whether the ID of the fourth device 24 is included in the revocation list of the first DB 200. The process of checking whether there is an ID of the fourth device 24 in the revocation list may be selectively performed, which will be described in detail in the revocation step to be described later. If there is no ID of the fourth device 24 in the revocation list, and the security management server 300 is set to the automatic mode, the security management server 300 derives the fourth device 24 from which the security vulnerability is derived. It is possible to automatically prepare a countermeasure against the security vulnerability, and provide the prepared agent to the fourth agent 24a.

The fourth agent 24a may compensate for security vulnerabilities derived by the measures provided from the security management server 300. For example, if the prepared action includes an instruction to delete the added account, the fourth agent 24a may delete the added account. In addition, if the prepared action allows the added account, the fourth agent 24a may recognize the added account as a normal account.

Alternatively, when a security vulnerability is reported from the fourth agent 24a, the security management server 300 may notify the administrator of the security vulnerability if the security management server 300 is set to the manual mode. If the administrator allows a security vulnerability, the security management server 300 may change the security policy set for the fourth device 24 to reflect the changed operating environment. The security management server 300 downloads the changed security policy to the fourth agent 24a, and the fourth agent 24a may check the security state of the fourth device 24 based on the changed security policy. have.

When a mail transmission server such as a Simple Mail Transfer Protocol (SMTP) server is provided in the security management server 300, the security management server 300 may notify the administrator of a security vulnerability by using the administrator's email account. Alternatively, when a processor for sending an SMS is provided in the security management server 300, the security management server 300 may transmit an SMS to the administrator, such as 'Please check since a security vulnerability has been found from the fourth device 24'. . Here, the 'manager' may be an administrator related to the communication infrastructure and I ² SM such as a security manager and an infrastructure operation person.

When a security vulnerability occurs when an administrator changes the system, the administrator may allow a security vulnerability through an administration screen provided by the security management server 300. In addition, when the security vulnerability is automatically caused by an external intrusion such as a virus, the administrator may not allow the security vulnerability and may manually provide the fourth agent 24a with respect to the security vulnerability. If an administrator manually checks for security vulnerabilities and takes corrective action, the administrator can manually recheck the status associated with the security vulnerabilities, thereby verifying the corrective results and corrective actions taken against the security vulnerabilities.

As described above, operations that the fourth agent 24a checks the security state of the fourth device 24 based on the security policy and take action when the security vulnerability is derived are performed by the fourth device 24 to provide a service. It can be performed at the operating stage.

On the other hand, when the service of the fourth device 24 is terminated, the fourth device 24 may enter the step of discarding in the communication infrastructure.

In the discarding step, the manager may access the device management server 100 through the third terminal 13 to perform the discarding procedure of the fourth device 24. When the discarding procedure is completed, the device management server 100 may additionally store the ID of the fourth device 24 in the device discard list of the first DB 200.

Meanwhile, if the security state of the fourth device 24 is continuously checked, the security management server 300 may notify the manager that the disposal of the fourth device 24 has not been performed. In detail, when the security state check result of the fourth device 24 is received from the fourth agent 24a, the security management server 300 may check the device revocation list of the first DB 200.

If there is an ID of the fourth device 24 in the device revocation list, the security management server 300 determines that the fourth device 24 is running on the communication infrastructure without actually being discarded, and gives the administrator the fourth device ( 24) may be notified that it is running. As a result, the administrator discards the fourth device 24 and prevents a security risk that may be caused by randomly operating the fourth device disposed in the communication infrastructure.

In addition, the security management server 300 grasps the license status of the fourth agent 24a, and if the license period remains, the fourth agent 24a is installed in a fifth device (not shown) newly installed in the communication infrastructure. By using this, the cost of purchasing a security management agent can be reduced.

3 is a block diagram illustrating a security management server according to an embodiment of the present invention.

Referring to FIG. 3, the security management server 300 may include a communicator 310, a storage 320, an alert generator 330, and a controller 340. Since the communication unit 310, the storage unit 320, the warning generation unit 330, and the control unit 340 perform the operations described with reference to FIGS. 1 and 2, detailed descriptions thereof will be omitted.

The communication unit 310 communicates with the first to fourth devices 21, 22, 23, and 24 through the second communication network 20, thereby communicating the first to fourth agents 21a, 22a, 23a, and 24a. In addition, the security policy may be downloaded to the first to fourth agents 21a, 22a, 23a, and 24a. In addition, the communication unit 310 receives from the first to fourth agents 21a, 22a, 23a, 24a periodically receives a report on the security status or a report on the found security vulnerability, and provides it to the controller 340. Actions for security vulnerabilities may be transmitted to the first to fourth agents 21a, 22a, 23a, and 24a.

The storage unit 320 includes programs necessary for the operation of the security management server 300, and first to fourth agents 21a, 22a to be downloaded to the first to fourth devices 21, 22, 23, and 24. , 23a, 24a may be stored. In addition, the storage 320 stores reports of the first to fourth agents 21a, 22a, 23a, and 24a, that is, a result of checking the security state, and measures for security vulnerabilities.

When the security vulnerability is reported from the first to fourth agents 21a, 22a, 23a, and 24a, the alert generation unit 330 may generate an alert to notify the administrator that a security vulnerability is found. For example, when the alert generator 330 is an SMTP server, the alert generator 330 may create an e-mail and transmit it to an administrator.

The controller 340 may control and manage the overall operation of the security management server 300. The controller 340 may perform the operations described with reference to FIG. 2 according to the introduction, installation, operation, and disposal steps of the first to fourth devices 21, 22, 23, and 24. For example, when the control unit 340 confirms through the first DB 200 that the first to fourth devices 21, 22, 23, and 24 are registered in the communication infrastructure, the first to fourth agents ( 21a, 22a, 23a, and 24a may be downloaded to the first to fourth devices 21, 22, 23, and 24. When the first to fourth agents 21a, 22a, 23a, and 24a are installed in the first to fourth devices 21, 22, 23, and 24, the control unit 340 may control the first to fourth agents. The security policy can be downloaded to 21a, 22a, 23a, 24a).

In addition, when it is reported that a security vulnerability is found from the first to fourth agents 21a, 22a, 23a, and 24a, the controller 340 automatically prepares an action that can compensate for the security vulnerability. It can be provided to four agents 21a, 22a, 23a, and 24a. Alternatively, when it is reported that a security vulnerability is found from the first to fourth agents 21a, 22a, 23a, and 24a, the controller 340 may notify the administrator that the security vulnerability is found.

Hereinafter, an intelligent integrated security management method by an intelligent integrated security management system according to an embodiment of the present invention will be described with reference to FIGS. 4 to 6. The intelligent integrated security management system of FIGS. 4 to 6 may be the intelligent integrated security management system described with reference to FIG. 1. Accordingly, the device management server, the security management server, and the fourth device illustrated in FIGS. 4 to 6 may be the device management server 100, the security management server 300, and the fourth device 24 illustrated in FIG. 1. .

4 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is introduced and installed in a communication infrastructure.

In operation S410, after the administrator accesses the device management server and registers a new device newly installed with the fourth device in the communication infrastructure, the security management server checks the first DB to confirm whether the fourth device is introduced into the communication infrastructure.

In operation S415, when the fourth device is introduced to the communication infrastructure, the security management server may download the security management agent to the fourth device.

In operation S420, the security management agent may be automatically installed and executed on the fourth device. The security management agent may clean the fourth device by reviewing the initial security of the fourth device and automatically discovering and taking action on security vulnerabilities of the fourth device.

In step S425, the security management agent may report to the security management server that the installation is complete.

In operation S430, the security management server may provide a security policy prepared in consideration of characteristics of the fourth device (eg, a service type or an operating system type) to the security management agent installed in the fourth device.

In operation S435, the security management agent may configure the fourth device to a clean state based on the provided security policy. The clean state is the result of automatically applying the security policy to the fourth device in accordance with the provided security policy.

In step S440, the security management agent reports that the security management server is configured in a clean state.

In operation S445, the security management server sets an operating environment of the fourth device. In operation S450, the security management server may notify the security management agent of the setting result.

In operation S455, the security management agent may report the technical constraints to the security management server when the technical constraints are found by comparing the set operating environment with the clean state of the fourth device.

In step S460, the security management server classifies the generated technical constraints as a security monitoring exception, and in step S465, the security policy may be changed to reflect the classified technical constraints in the security policy.

In operation S470, the security management server may provide the security management agent with the security policy changed in operation S465. Therefore, the security management agent checks the security state of the fourth device based on the changed security policy.

5 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is operating in a communication infrastructure.

In operation S500, the fourth device in which the operating environment is set provides a service.

In operation S510, the security management agent installed in the fourth device may periodically check the security state of the fourth device based on the security policy.

In operation S520, when the security vulnerability is derived by analyzing the security result check result, in operation S30, the security management agent may automatically report the inspection result including the security vulnerability derived to the security management server. A security vulnerability may be caused by an infection of a virus or may be caused by a change of a system (ie, an operating environment) of a fourth device by an administrator.

In operation S540, if the automatic mode is set in the security management server, in operation S550, the security management server may automatically prepare an action for the derived security vulnerability. Measures in place can be one of the ways to accommodate or eliminate changes in the system that caused the security vulnerability.

In operation S560, the security management server may provide the prepared action to the security management agent.

In step S570, the security management agent may compensate for the security vulnerability according to the measures provided from the security management server. For example, if the action includes an instruction to remove a change in the system that caused the security vulnerability, the security management agent can undo the change in the system. In addition, if the action includes an indication to accept a change in the system that is the source of the vulnerability, then the security management agent accepts the change in the system and does not subsequently derive it as a security vulnerability.

On the other hand, if a manual mode other than the automatic mode is set in the security management server in step S540, in step S580, the security management server may notify the administrator that a security vulnerability has been derived.

In step S590, the administrator notified that the security vulnerability has been derived can directly access the fourth device to take action on the security vulnerability manually. In addition, although not shown, in the manual mode, the administrator may provide an action through the security management server, and the security management server may provide the provided action to the security management agent.

6 is a flowchart illustrating an intelligent integrated security management method according to an embodiment of the present invention performed while a new device is discarded in a communication infrastructure.

When the service of the fourth device is terminated, the administrator accesses the device management server to perform the discarding procedure of the fourth device, and in operation S610, the device management server may receive the discarding procedure.

In operation S620, the device management server instructs to add the ID of the fourth device to the device revocation list of the DB. In operation S630, the DB may add and store the ID of the fourth device to the device revocation list.

In operation S640, when the inspection result of checking the security state of the fourth device is reported from the security management agent installed in the fourth device, in operation S650, the security management server checks the device revocation list of the DB.

In operation S660, if the ID of the fourth device exists in the device revocation list, in operation S670, the security management server may determine that the fourth device provides the service without revocation in the communication infrastructure, and may notify the administrator. .

In operation S680, the manager may actually discard the fourth device.

On the other hand, if the ID of the fourth device does not exist in the device revocation list as a result of checking in step S660, the security management server may enter to step S540.

Meanwhile, the functions provided by the security management server 300 or the security management agent (hereinafter, described with the fourth agent 24a as an example) are summarized as follows.

1. The security management server 300 and the fourth agent 24a may automatically perform the management process and the security management process of the first to fourth devices 21, 22, 23, and 24 described with reference to FIG. 2. Can be.

2. The security management server 300 checks the information of a device newly introduced to the communication infrastructure stored in the first DB 200 at any time by an automatic linkage function with the first DB 200, and then checks the information in the first DB 200. Based on the information, the security policy created by the security management server 300 may be automatically applied to the newly introduced device.

3. The security management server 300 may automatically create a security policy for automatically applying a device newly introduced to the communication infrastructure according to the characteristics of the device.

4. The security management server 300 is the security level of the first to fourth devices (21, 22, 23, 24), security management exceptions, statistics, the first to fourth devices (21, 22, 23, 24) You can create a dashboard (DashBoard) that can check the users, etc. connected to the administrator and provide it to the administrator through the management screen.

5. The security management server 300 checks the security status of the first to fourth devices 21, 22, 23, and 24 introduced into the communication infrastructure, and prepares for the action. Host names, operating systems, IP addresses, comments, and the like of 21, 22, 23, and 24 may be written and managed in the second DB 400 or the storage unit 330.

6. The security management server 300 or the fourth agent 24a automatically checks the first to fourth devices 21, 22, 23, and 24 for providing functions of various servers, DBMSs, network / security devices, and the like. Can be performed on a daily basis, or by selecting only the devices that need to be checked.

7. The security management server 300 is HTML (HyperText Markup Language) that can analyze the security status check results of the first to fourth devices (21, 22, 23, 24) by comparing with the group security check list written in advance It can provide a web-based reporting function. The group security checklist means that the security policies established by security centers of companies such as Samsung are registered and templated in the system.

8. The security management server 300 may provide an access control linkage management function using an Internet Protocol Security Protocol (IPSec) for a server (for example, the first device 21) operating based on Windows. have. The access control linkage management function can restrict access and operation of the first device 21 based on IP and port by using a remote access / control program such as terminal service, PC Anywhere, and Virtual Network Computing (VNC). to be.

9. The security management server 300 or the fourth agent 24a organizes the security status check results of the first to fourth devices 21, 22, 23, and 24 by OS, device name, date, and the like. It may be stored in the second DB 400, which may be easily used when searching for the first to fourth devices 21, 22, 23, and 24.

10. The fourth agent 24a may provide a reporting function to check the status of the equipment having a reduced security level on a daily basis to identify unauthorized changes. As described above, the security vulnerability refers to a content that can be developed into a security risk by an external security threat among the attributes of the device (eg, the fourth device 24). The discovery of new security vulnerabilities means that changes have been made, such as adding settings within the equipment and installing services, and that there are attributes that can develop into security risks by external security threats. Therefore, it is necessary to check / correct security vulnerabilities after the change and manage the related contents through the change process. If unauthorized changes were made without compliance with the change process, then the security vulnerability is also unmanaged and exists on the device. In order to manage these parts, you can check the compliance of the process by reporting the equipment with the newly occurring security vulnerability daily.

11. The security management server 300 or the fourth agent 24a may classify the technical constraints generated when setting the operating environment of the fourth device as a security monitoring exception and store and manage them in the second DB 400.

12. The security management server 300 applies an expiration date to the classified security monitoring exceptions, and separately displays the security monitoring exceptions that have expired on the management screen so that the administrator can check them at any time.

13. The security management server 300 stores the evidence documents for the security monitoring exceptions in the second DB 400, provides a search function, and the administrator can search and track the security monitoring exceptions through the search function. .

While the present invention has been described with reference to the particular embodiments and drawings, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. This is possible. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

100: device management server 200: first database
300: security management server 400: second database
11, 12, 13: first to third terminals
21, 22, 23, 24: first to fourth devices

Claims (20)

In the intelligent integrated security management method for a plurality of devices forming a communication infrastructure,
Checking a security state of each of the devices using a security policy for each of the plurality of devices;
Analyzing the check result to derive a security vulnerability;
Providing a countermeasure against the security vulnerability of the plurality of devices from which the security vulnerability is derived;
Supplementing the derived security vulnerability according to the prepared action; And
Deriving a security vulnerability according to the changed operating environment when the operating environment of the at least one device is changed while at least one device of the plurality of devices is operated to provide a service; How to manage. The method of claim 1,
When the at least one of the plurality of devices is installed in the communication infrastructure, configuring the at least one device in a clean state based on a security policy for the at least one device;
The checking of the security state may include checking a security state of at least one device in the clean state. The method of claim 2,
And at least one device in the clean state is configured to set an operating environment. The method of claim 3,
And changing a security policy for the at least one device to conform to an operating environment of the at least one device in the clean state. 5. The method of claim 4,
And configuring the clean state, receiving the setting, and changing the security policy are performed while the plurality of devices are introduced and installed in the communication infrastructure. delete The method of claim 1,
Notifying an administrator of the derived security vulnerability; And
And when the administrator allows the security vulnerability, changing a security policy for at least one device whose operation environment has been changed. The method of claim 1,
And when the security vulnerability is derived, preparing an action for the security vulnerability is automatically performed by a security management server. The method of claim 1,
When at least one of the plurality of devices is discarded in the communication infrastructure, recording the fact of discarding the at least one device in a database; And
And notifying an administrator that revocation of the at least one device has not been performed if the security status of the at least one device is continuously checked. delete In the intelligent integrated security management system for a plurality of devices forming a communication infrastructure,
A security management agent for checking a security state of each device by using a security policy for each of the plurality of devices, and analyzing the check result to derive a security vulnerability; And
A security management server for providing a countermeasure against the security vulnerability among the devices from which the security vulnerability is derived among the plurality of devices;
The security management agent compensates for the derived security vulnerability according to the measures provided by the security management server, and while at least one of the plurality of devices is operated to provide a service, operation of the at least one device Intelligent integrated security management system that derives security vulnerabilities according to the changed operating environment when the environment is changed. The method of claim 11,
The security management agent, when at least one of the plurality of devices is provided in the communication infrastructure, configure the at least one device in a clean state based on a security policy for the at least one device, Intelligent integrated security management system, characterized in that for checking the security state of at least one device in a clean state. The method of claim 12,
And when the operating environment of the at least one device in the clean state is set, the security management server changes a security policy for the at least one device to match the set operating environment. The method of claim 13,
The configuring of the at least one device to a clean state, checking the security state, and changing the security policy by the security management agent is performed while the plurality of devices are introduced into and installed in the communication infrastructure. Intelligent integrated security management system, characterized in that. delete The method of claim 11,
The security management server notifies the administrator of the derived security vulnerability, and when the administrator allows the security vulnerability, intelligent integrated security, characterized in that for changing the security policy for at least one device whose operating environment has changed. Management system. The method of claim 11,
And when the security vulnerability is derived, the security management server automatically prepares an action for the security vulnerability. The method of claim 11,
If one of the plurality of devices is discarded in the communication infrastructure, further comprising a database for recording the fact of the discard of the one device;
And the security management server notifies the administrator that the disposal of the one device is not performed when the security state of the one device is continuously checked. The method of claim 11,
And the security management server provides the security management agent with a security policy for each of the plurality of devices. A computer-readable recording medium having recorded thereon a program for executing the method of any one of claims 1 to 5 and 7 to 10 on a computer.

Images