KR102263111B1 - Method for data security management and recording medium recording program for performing the method - Google Patents

Abstract

A data security management method for files existing in a data storage system in a group according to an aspect according to the technical spirit of the present disclosure includes the steps of detecting a file created, changed, or accessed in the data storage system, the detected Acquiring a response scenario corresponding to the detected risk level among a plurality of response scenarios based on the detected risk level for the file, and performing a plurality of response methods included in the obtained response scenario according to a set processing order , performing a data security management operation for the detected file.

Description

Data security management method and recording medium for recording the program for performing the same {METHOD FOR DATA SECURITY MANAGEMENT AND RECORDING MEDIUM RECORDING PROGRAM FOR PERFORMING THE METHOD}

A technical idea of the present disclosure relates to a data security management method and a recording medium recording a program for performing the same.

With the recent development of communication technology and the development of data processing technology, and the generalization of data computerization, the amount of data created and managed by a group such as a company or organization has rapidly increased. On the other hand, the development of such communication technology and the development of data processing technology also facilitates data duplication or leakage, and thus damage due to leakage of personal or confidential information is also increasing.

In the conventional case, companies and the like introduced various security solutions such as a data loss prevention (DLP) solution to prevent information or data leakage. However, there is a problem in that the conventional security solution cannot effectively manage various types and types of files or data by providing only a uniform and primitive level management function for files and data existing in a group.

In addition, in recent years, data may be leaked in various forms through group community bulletin boards or SNS, as well as files of standardized data such as documents, so a method that can effectively analyze and manage such unstructured data may be required. have.

The technical problem to be solved by the present invention is to provide a data security management method capable of complexly applying various response methods for security management of files or data.

The technical problem to be solved by the present invention is to provide a data security management method that can easily combine the above response methods according to the environment of a group such as a company.

In order to achieve the above object, a data security management method for files existing in a data storage system in a group according to an aspect according to the technical idea of the present disclosure, a terminal connected to the data storage system detecting a file created, changed, or accessed by, based on the detected risk level for the detected file, obtaining a corresponding scenario corresponding to the detected risk level among a plurality of response scenarios; and and performing a data security management operation on the detected file by performing a plurality of response methods included in the response scenario according to a set processing order.

According to an embodiment, the plurality of corresponding scenarios may be provided for each risk level of files existing in the data storage system.

According to an embodiment, each of the plurality of corresponding methods is defined as a processing operation for data security management of a file, and the processing operation includes deletion, movement, copying, encryption, de-identification, and notification to an administrator of the file. may include at least one of

According to an embodiment, the data security management method includes receiving a request for generating or changing a corresponding scenario from a terminal, and providing an interface for generating or changing a corresponding scenario to the terminal in response to the received request , receiving, based on the provided interface, an input for generating or changing a corresponding scenario in which a plurality of corresponding ways and a processing order of the plurality of corresponding ways are defined, and a corresponding scenario generated or changed based on the received input It may further include the step of storing.

According to an embodiment, the interface includes a screen output through the display of the terminal, and the screen is a corresponding scenario for setting and displaying a selection area for selection of a plurality of corresponding methods, the selected corresponding methods, and a processing order It may include an area and a detailed setting area for setting conditions for each of the selected corresponding methods.

According to an embodiment, the data security management method includes determining, based on the sensitive data included in the file, the sensitive data or at least one related file having data related to the sensitive data, and the determined at least one The method may further include providing information about the related file.

According to an embodiment, the performing of the data security management operation for the detected file includes: checking a file related to the detected file; and using a corresponding scenario for the detected file, the checking The method may further include performing a data security management operation for the associated file.

According to an embodiment, the data security management method further includes the step of evaluating the risk of each of the files existing in the data storage system by using an artificial intelligence model that learns the risk of a keyword or pattern included in the files. may include

According to an embodiment, the evaluating of the risk may include evaluating the risk of the file by reflecting the risk of the URL when the URL is included in the file.

A computer-readable recording medium according to an aspect according to the technical spirit of the present disclosure may record a program for performing data security management methods according to embodiments of the present disclosure.

According to the technical idea of the present disclosure, the data security management method provides a response scenario in which a plurality of response methods for data security management are combined according to the degree of risk of the files, thereby improving data security management compared to conventional uniform security management technologies. effect can be maximized.

In addition, the data security management method provides an interface for generation of a response scenario through a combination of a plurality of response methods and management of the generated response scenario, so that a group manager or the like can more easily manage a response scenario optimized for the environment of the group to be created and managed.

Effects that can be obtained by the data security management method according to the technical idea of the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned above can be obtained from common knowledge in the technical field to which the present invention belongs from the description below. It will be clearly understood by those who have it.

In order to more fully understand the drawings cited in this disclosure, a brief description of each drawing is provided.
1 is a conceptual diagram of a data security management system including a data security management module according to an exemplary embodiment of the present disclosure.
2 is a schematic block diagram of a data security management module according to an exemplary embodiment of the present disclosure.
3 to 6 show examples of various information provided based on the processing operation of the data security management module according to the present disclosure.
7 is a flowchart for explaining an example of an operation in which the data security management module according to the present disclosure performs data security management for a file in a data storage system.
8 is a diagram illustrating examples of corresponding methods that the data security management module according to the present disclosure may perform for data security management for an identified file.
9 to 11 are diagrams illustrating examples of response scenarios provided for each risk level of a file.
12 is a flowchart for explaining a corresponding scenario setting operation of the data security management module according to an exemplary embodiment of the present disclosure.
13 is an exemplary diagram of a user interface related to the corresponding scenario setting operation of FIG. 12 .

Exemplary embodiments according to the technical spirit of the present disclosure are provided to more fully explain the technical spirit of the present disclosure to those of ordinary skill in the art, and the following embodiments are modified in various other forms may be, and the scope of the technical spirit of the present disclosure is not limited to the following embodiments. Rather, these embodiments are provided to more fully and complete the present disclosure, and to fully convey the technical spirit of the present invention to those skilled in the art.

Although the terms first, second, etc. are used in this disclosure to describe various members, regions, layers, regions, and/or components, these members, parts, regions, layers, regions, and/or components refer to these terms. It is obvious that it should not be limited by These terms do not imply a specific order, upper and lower, or superiority, and are used only to distinguish one member, region, region, or component from another member, region, region, or component. Accordingly, a first member, region, region, or component to be described below may refer to a second member, region, region, or component without departing from the teachings of the present disclosure. For example, without departing from the scope of the present disclosure, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

Unless defined otherwise, all terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the concepts of this disclosure belong, including technical and scientific terms. Also, commonly used terms as defined in the dictionary should be construed as having a meaning consistent with what they mean in the context of the relevant technology, and unless explicitly defined herein, in an overly formal sense. shall not be interpreted.

In cases where certain embodiments may be implemented differently, a specific process sequence or process sequence may be performed differently from the described sequence. For example, two processes or processes described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the order described.

In addition, terms such as "~ unit", "~ group", "~ character", and "~ module" described in this specification mean a unit that processes at least one function or operation, which is a processor, a micro Processor (Micro Processor), Micro Controller (Micro Controller), CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerate Processor Unit), DSP (Drive Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA It may be implemented as hardware or software such as (Field Programmable Gate Array), or a combination of hardware and software, and may be implemented in a form combined with a memory that stores data necessary for processing at least one function or operation. .

In addition, it is intended to clarify that the classification of the constituent parts in the present specification is merely a classification for each main function that each constituent unit is responsible for. That is, two or more components to be described below may be combined into one component, or one component may be divided into two or more for each more subdivided function. In addition, each of the constituent units to be described below may additionally perform some or all of the functions of other constituent units in addition to the main function it is responsible for. Of course, it may be carried out by being dedicated to it.

As used herein, the term 'and/or' includes each and every combination of one or more of the recited elements.

Hereinafter, embodiments according to the technical spirit of the present disclosure will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram of a data security management system including a data security management module according to an exemplary embodiment of the present disclosure.

Referring to FIG. 1, the data security management system 1 protects the group's data through security management of files or data existing in the data storage system 10 of a group, such as a specific organization or company, and protects confidentiality, integrity, and may be provided to improve availability. The data storage system 10 is connected to the database 11 and the database 11 to store various files and data created or managed within the group to access the files and data in the database 11, or to store the created files. It may include a file server 12 and/or a cloud server 13 that is provided and stored as the database 11 .

Members of the group access the file server 12 or the cloud server 13 through the terminals 21 , 22 , 23 of the internal network 20 or the terminals 31 , 32 , 33 of the external network 30 . By doing so, it is possible to access the database 11 of the data storage system 10 . In this case, the members may intentionally or unintentionally leak a file including sensitive data such as personal information or confidential information to the outside among the files existing in the database 11 . In the conventional case, security solutions such as data loss prevention (DLP) and digital rights management (DRM) for security management of these files or data have been provided, but the conventional security solution provides uniform security management operations (deletion, blocking, etc.), there is a limitation in that it cannot provide an appropriate security management operation according to the characteristics of a file or data.

The data security management system 1 according to the present disclosure may include the data security management module 100 included in the data storage system 10 or connected to the data storage system 10 . The data security management module 100 may maximize the security level of group data by providing various security management operations according to characteristics of files or data existing in the data storage system 10 .

The data security management module 100 may be implemented in hardware, software, or a combination thereof. According to an embodiment, the data security management module 100 is a software installed and executed in at least one of the database 11 , the file server 12 , and/or the cloud server 13 of the data storage system 10 . may be provided in the form. According to an embodiment, the data security management module 100 may be implemented as a separate computing device connected to the database 11 , the file server 12 , and/or the cloud server 13 . In this case, the data security management module 100 includes at least one processor for processing various data security management operations to be described later, and at least one memory for storing information, data, algorithms, commands, etc. related to the data security management operation. may include

2 is a schematic block diagram of a data security management module according to an exemplary embodiment of the present disclosure. 3 to 6 show examples of various information provided based on the processing operation of the data security management module according to the present disclosure.

Referring to FIG. 2 , the data security management module 100 includes a data identification and classification module 110 , a data tracking module 120 , a risk assessment module 130 , a data analysis and monitoring module 140 , and a corresponding management module (150). Since the data security management module 100 does not include only the modules 110 to 150 of FIG. 2 , the data security module 100 may include more or fewer modules according to an embodiment.

The data identification and classification module 110 may identify files (or data) existing in the data storage system 10 and classify the identified files. For example, the data identification and classification module 110 may analyze the format, extension, content, header, structure, etc. of the files, and classify and classify the categories of the files based on the analysis result. The category may include, but is not limited to, documents, executable files, compressed files, images, media, support files, and the like. According to an embodiment, the data identification and classification module 110 may identify and classify not only standardized data such as document files or image files, but also various data such as posts of group communities (eg bulletin boards).

The data tracking module 120 may perform a tagging operation of assigning a tag indicating classification information (eg, personal information, confidentiality, etc.) of sensitive data in the file to the file. In addition, the data tracking module 120 enables continuous management of files by adding/changing/deleting tags in response when sensitive data is added/changed/deleted as the contents of the file are changed. .

According to an embodiment, the data tracking module 120 may identify and manage a source source and/or a related file for sensitive data in a specific file. For example, the data tracking module 120 determines, as a source source, a file having the sensitive data or data related to the sensitive data among files with a creation date or last modification date earlier than the specific file, and manages it together with the specific file. can In addition, the data tracking module 120 may determine at least one related file including the same data as the sensitive data included in the specific file or related data and manage it together with the specific file.

According to an embodiment, when a file having sensitive data is leaked or spread, the data tracking module 120 may allow an administrator to identify and manage the leaked state of the corresponding file by checking and tracking the spread path.

The risk assessment module 130 may analyze data (contents, etc.) of the file and evaluate the risk of the file based on the analysis result. According to an embodiment, the risk assessment module 130 may include an artificial intelligence engine (model) that learns the degree of risk according to the similarity and connectivity, occurrence frequency, and importance of keywords or patterns according to a specific policy. For example, the artificial intelligence engine may include an artificial neural network learned according to deep learning, but is not limited thereto. The risk assessment module 130 may analyze a keyword or pattern included in the file using the artificial intelligence engine, and evaluate the risk of the file based on the analysis result. According to an embodiment, when the URL is included in the file, the risk assessment module 130 may evaluate the risk of the URL through a risk check on the URL, and reflect the evaluation result in the risk assessment of the file.

For example, the risk assessment module 130 may classify the risk of the file into any one of a plurality of steps. The correspondence management module 150, which will be described later, may perform different data security response operations according to the classified risk level for the file.

The data analysis and monitoring module 140 may provide information on the data security risk level of the data storage system 10 based on the file identification and classification result, the tracking result, and the risk evaluation result. For example, the data security management module 100 may monitor files accessed by terminals of group members among the files of the data storage system 10 in real time. As a result of monitoring, it may be determined that the higher the number of high-risk files among the accessed files, the higher the data security risk. Meanwhile, the accessed file may be understood as a concept including not only a file already existing in the data storage system 10 but also a file created or changed by a terminal of a group member.

According to an embodiment, the data analysis and monitoring module 140 may include pre-classified risk assessment information for each field (eg, legal field, financial field, medical field, etc.) or risk type (personal information, In-group security information, sensitive information, etc.) information on the occurrence trend can also be provided in real time. Alternatively, the data analysis and monitoring module 140 may provide monitoring results for a predetermined period to enable an administrator to observe and manage data security risk status.

The data security management module 100 may provide a variety of information based on the above-described operation to the manager of the data storage system 10 . For example, the information may be provided through a display of a device including the data security management module 100 or a device connected thereto.

Referring to the embodiment of FIG. 3 , the data security management module 100 may provide a screen 300 indicating the identification and classification results of files existing in the data storage system 10 . For example, the screen 300 may be configured to provide classification information 310 by category of files, distribution information 320 of sensitive data, and potentially dangerous file information 330 in a visual form. The category-specific classification information 310 may be provided by displaying the number of files corresponding to each of the file categories in a graph. The sensitive data distribution information 320 may be provided as statistics on files including sensitive data among files or files of a specific category. The potentially dangerous file information 330 may include a list of files predicted to have a high risk based on tag information of each of the files. According to an embodiment, the potential risk file information 330 may include a list of files determined to be high in risk by the risk assessment module 130 .

Referring to the embodiments of FIG. 4 , the data security management module 100 may output screens 410 , 420 , and 430 indicating information based on the operation of the data tracking module 120 . For example, the data security management module 100 may provide the detailed information screen 410 including a category, a risk level, a tag, a URL, etc. for a specific file. Alternatively, the data security management module 100 may provide a screen 420 including a list of files corresponding to the source source of the sensitive data included in the specific file. In addition, when the data security management module 100 leaks and spreads a specific file, based on a correlation analysis or correlation analysis for the sensitive data of the specific file, the data security management module 100 indicates the result of checking and tracking the spread path of files including sensitive data. A screen 430 may be provided. The screen 430 may include information on the specific file and/or files including the sensitive data, and information on a diffusion path (distribution number, etc.) of each of the files.

Referring to the embodiment of Figure 5, the data security management module 100, based on the risk assessment result for each of the files of the data storage system 10, the risk of each of the files and keyword information related to sensitive data It may provide a risk analysis screen 500 including. The risk analysis screen 500 includes a search condition setting area 510 for searching files based on risk, etc., a search result area 520 providing a list of files corresponding to the set search condition, and a search result area 520 . ) may include a detailed information area 530 providing detailed information on the selected file among the files. The detailed information may include details such as a category, creation date, and modification date of the file, information on keywords related to sensitive data included in the file, and/or information on a distribution trend of sensitive data in the file. Among them, information on keywords related to sensitive data may include information on other keywords related to the keyword as well as keywords included in the file. Based on the information of the keywords, the administrator can easily check and recognize the sensitive data included in the file.

Referring to the embodiment of FIG. 6 , the data security management module 100 includes information related to the data security risk level of the data storage system 10 based on the monitoring result for the files of the data storage system 10 . A screen 600 may be provided. For example, the screen 600 is a real-time data security risk level 610 based on the monitoring results of files (including files that are created or changed) accessed to the data storage system 10, summary information and statistical information 620 based on the monitoring results. ) may be included.

Based on the information provided according to the embodiments of FIGS. 3 to 6 , the manager of the data storage system 10 easily acquires and recognizes various information related to the security risk of files in the system, thereby providing information to the data storage system 10 . management tasks can be performed more efficiently.

Fig. 2 will be described again.

The data security management module 100 according to the present disclosure may include a corresponding management module 150 that performs a data security management operation for each of the files. According to an embodiment, the response management module 150 performs a data security management operation based on a response scenario corresponding to the risk of each of the files evaluated by the risk assessment module 130 by performing a data security management operation. Enables data security management.

The response scenario may be configured to include information related to a plurality of response schemes and their processing order. That is, the data security management method according to the present disclosure does not take only a single response method according to a specific policy or risk level, but rather takes a response measure for data security of a file according to a complex and step-by-step response scenario combining a plurality of response methods. can be done effectively. Examples of a plurality of response methods that may be included in a response scenario will be described later with reference to FIG. 8 .

The correspondence management module 150 may include a corresponding scenario setting module 152 , a user interface providing module 154 , and a correspondence processing module 156 . The response scenario setting module 152 performs setting and management (selection, creation, change, deletion, etc.) of the response scenario by risk level, and the user interface providing module 154 allows the administrator to provide an interface for managing the response scenario can do The correspondence processing module 156 may process a data security management operation for the file based on the correspondence scenario. For example, when an accessed file (including a file that is created or changed) is detected, the corresponding processing module 156 may process a data security management operation according to a corresponding scenario corresponding to the degree of risk of the detected file.

Hereinafter, specific embodiments of a data security management operation performed by the corresponding management module 150 will be described with reference to FIGS. 7 to 13 .

7 is a flowchart for explaining an example of an operation in which the data security management module according to the present disclosure performs data security management for a file in a data storage system.

Referring to FIG. 7 , as described above in FIG. 2 , the data security management module 100 may identify and classify files in the data storage system 10 ( S700 ), and detect a degree of risk for the identified files ( S700 ). S710).

The data security management module 100 may detect a file (including a file that is created or changed) accessed by a member of a group in the data storage system 10 , and may detect and confirm a degree of risk for the detected file.

Although an embodiment in which the level of risk is classified into five levels is disclosed in the present specification, there may be fewer or more levels of classification of the level of risk.

The data security management module 100 may acquire a corresponding scenario corresponding to the detected risk (S720). The data security management module 100 may process a data security response for the identified file by performing a plurality of response methods included in the acquired response scenario according to a set order ( S730 ).

The data security management module 100 may acquire a corresponding scenario for data security management of the identified file based on the detected risk level for the identified file. For example, the data security management module 100 may obtain (load) a corresponding scenario corresponding to the level of risk detected with respect to the identified file from among the corresponding scenarios set for each risk level.

According to an embodiment, a plurality of response scenarios may be set for each risk level. For example, scenarios corresponding to the same level of risk may be distinguished from each other based on a file category, a type of sensitive data, and the like. In this case, the data security management module 100 selects a corresponding scenario corresponding to the category of the identified file or the type of sensitive data included in the file from among the corresponding scenarios corresponding to the level of risk detected for the identified file. It can be obtained (loaded).

The data security management module 100 may perform a corresponding operation for data security management for the identified file by performing a plurality of corresponding methods included in the obtained corresponding scenario according to a set processing order. That is, according to the present disclosure, more effective data security management for a file can be performed according to an optimal response scenario corresponding to the risk level or characteristic of the file.

Although not shown, the data security management module 100 performs the data security management module 100 for at least one file associated with the identified file among the files existing in the data storage system 10 according to the same corresponding scenario as the identified file. A corresponding action for security management may be performed. For example, the at least one associated file may correspond to the same data as sensitive data included in the identified file or a file including related data. According to an embodiment, when risk information on the associated file exists, the data security management module 100 uses a corresponding scenario for a higher risk among the identified file risk and the associated file risk, A corresponding operation for data security management for the file and/or the identified file may be performed.

8 is a diagram illustrating examples of corresponding methods that the data security management module according to the present disclosure may perform for data security management for an identified file.

The corresponding methods shown in FIG. 8 correspond to an embodiment for describing the technical features of the present disclosure, and the types and number of the corresponding methods are not limited to FIG. 8 .

Based on this, referring to FIG. 8 , a plurality of corresponding methods may be divided into a plurality of categories. For example, the plurality of categories may include final correspondence 810 , custom correspondence 820 , encryption 830 , de-identification 840 , and notification 850 , each category having at least one correspondence manner. may be included.

As an example, the final response 810 may include general deletion, wiping according to DoD5220.22, wiping according to Peter Gutmann method, and quarantine. Custom correspondence 820 may include moving, copying, extracting contents, specifying an expiration date, and full scan of a file, and encryption 830 may include encryption of a file, one-way encryption, two-way encryption, and password setting. De-identification 840 may include pseudonymization (formal), pseudonymization (random value), deletion of all values, partial deletion of values, addition of random noise, and masking, and notification 850 includes collection, notification, and warning. may be included.

The correspondence scenario may include two or more of the plurality of correspondence methods, and information on a processing order between the included correspondence methods may be included. Hereinafter, some examples of response scenarios for each risk level will be described with reference to FIGS. 9 to 11 .

9 to 11 are diagrams illustrating examples of response scenarios provided for each risk level of a file.

9 to 11 , the data security management module 100 may provide screens 900 , 1000 , and 1100 including information on corresponding scenarios for each risk level. For example, the screens 900 , 1000 , and 1100 may display response scenario areas 920 , 1020 , 1120 indicating a response scenario for the currently selected risk level through the risk level windows 930 , 1030 , 1130 , and response methods included in the response scenario It may include description windows 940 and 1040 indicating information on the selected correspondence method.

Referring to the embodiment of FIG. 9 , the response methods included in the response scenario of risk '1' (lowest) are pseudonymization (formation) and notification, and the processing order (execution order) is pseudonymization (formation) performed. Post notification may be set to be performed.

The data security management module 100, when a file with a risk of '1' among the files of the data storage system 10 is detected, uses the identification information (name, phone number, address, etc.) of a specific person existing in the file as pseudonym information. It can be replaced (modified). The data security management module 100 may provide the pseudonymized file when requesting to read or download the corresponding file. In addition, the data security management module 100 transmits (notifies) a notification including information on the detected file to the terminal of the administrator, or when access of the file is detected, information on the accessed file and/or information on the accessed member It is possible to transmit (notify) a notification including the like to the terminal of the manager.

Referring to the embodiment of FIG. 10 , the response methods included in the response scenario of risk '3' (medium) may correspond to copying, random noise addition, masking, password setting, quarantine, and warning. In addition, the processing order of the corresponding schemes may include the order of copying, random noise addition, masking, and encryption setting, and the order of copying, quarantine, and warning.

When a file having a risk level of '3' is detected among the files of the data storage system 10 , the data security management module 100 may first copy the file. Thereafter, the data security management module 100 adds arbitrary noise to specific text among the data of the copy (or original) to make it difficult to search or recognize the text, and processes the file through masking for sensitive data. Sensitive data inside is processed so that it cannot be identified, and a password can be set to make it impossible for unauthorized users to view the file. Accordingly, data in the file is prevented from being provided to an unauthorized user, and sensitive data can be protected. In addition, the data security management module 100 performs quarantine processing on the detected file, and provides a warning about the detected file to an administrator (transmitting a warning message to a terminal such as an administrator), thereby causing an administrator to detect the detection. You can make it possible to perform additional countermeasures for the deleted files. For example, the quarantine processing may refer to a processing operation of encrypting the file, moving it to a separate database (eg, quarantine DB, etc.), and deleting the original file.

Referring to the embodiment of FIG. 11 , the response methods included in the response scenario of risk '5' (the highest) are copying, content extraction, quarantine, complete deletion according to DoD 5220.22, all deletion, expiration date designation, notification, and collection may correspond to In addition, the processing order of the corresponding methods is the order of copying, content extraction, and quarantine, and the order of copying, content extraction, full deletion of values, expiration date designation, notification, and collection, and the order of complete deletion according to DoD 5220.22 after copying. may include

When a file having a risk of '5' is detected among the files of the data storage system 10 , the data security management module 100 may copy the first detected file. The data security management module 100 may extract only a portion corresponding to content among data of the copy (or original). After content extraction is completed, the original file may be moved to a specific location (eg, inaccessible location, etc.) in the data storage system 10 . The data security management module 100 deletes all data that violates a preset rule among data (text, etc.) included in the content in order to de-identify the extracted content, and then designates an expiration date for the content. can In this case, when the expiration date elapses, access to the content may become impossible by a method such as setting an arbitrary password to a file including the content. In addition, the data security management module 100 may notify an administrator of information on the detected file, collect incident information similar to the detected file, and provide it to an administrator or the like. Also, the data security management module 100 may perform quarantine processing on a file including the extracted content. In addition, the data security management module 100 removes the copied file through complete deletion according to DoD 5220.22 when a preset period for the copied file has elapsed, so that the copied file remains in the data storage system 10 . can be prevented from doing

As in the above-described embodiments, the data security management module 100 performs optimized data security management for the files of the data storage system 10 by performing a plurality of response methods included in the response scenario according to a set processing order. make it possible

According to an embodiment, the screens 900 , 1000 , and 1100 may correspond to a user interface screen that enables an administrator to set and manage (create, change, or delete) a corresponding scenario. In this case, the screens 900 , 1000 , and 1100 may further include a selection area 910 for selecting corresponding methods. A specific embodiment related to setting and management of a corresponding scenario will be described below with reference to FIGS. 12 to 13 .

12 is a flowchart for explaining a corresponding scenario setting operation of the data security management module according to an exemplary embodiment of the present disclosure. 13 is an exemplary diagram of a user interface related to the corresponding scenario setting operation of FIG. 12 .

Referring to FIG. 12 , the data security management module 100 may receive a corresponding scenario setting request from an administrator or the like ( S1200 ).

For example, the corresponding scenario setting request may include, but is not limited to, a request for creation of a new corresponding scenario or a change request (or a deletion request) of an existing corresponding scenario.

In response to the received request, the data security management module 100 may output an interface for setting a corresponding scenario (S1210). The data security management module 100 may receive a setting input of a corresponding scenario based on the output interface (S1220) and store the set corresponding scenario (S1230).

The data security management module 100 may provide an interface for setting a corresponding scenario in response to a request for setting a corresponding scenario received from a terminal of an administrator or the like. The device (server, etc.) on which the data security management module 100 is executed may transmit data related to the interface to the manager's terminal, and the manager's terminal may output the interface through a display based on the received data. . According to an embodiment, when the data security management module 100 is a computing device including a display, the interface may be output through the display of the computing device.

On the other hand, the interface may correspond to the screens 900, 1000, and 1100 shown in FIGS. 9 to 11, and the administrator can select areas 910, 1010, 1110 included in the screens 900, 1000, and 1100 and An input operation for setting a corresponding scenario may be performed using the corresponding scenario areas 920 , 1020 , and 1120 .

Referring to the embodiment of FIG. 13 , the data security management module 100 may provide a creation screen 1300 for generating a corresponding scenario in response to a request from an administrator or the like. For example, the generation screen 1300 includes a selection area 1310 for selecting a corresponding method, a corresponding scenario area 1320 for generating a corresponding scenario by setting a processing order of the corresponding methods selected through the selection area 1310, and a focused It may include a detailed setting area 1330 , a reset button 1340 , and a save button 1350 for detailed setting of the corresponding method.

For example, the administrator moves (drag and drop, etc.) a corresponding method 1321 of a plurality of corresponding methods displayed through the selection area 1310 to the corresponding scenario area 1320, and the corresponding method ( 1321) can be added to the response scenario. In addition, the administrator may set the processing order of the corresponding methods existing in the corresponding scenario area 1320 , and may set conditions such as a period through detailed settings for each of the corresponding methods. Although not shown, the administrator may directly create a desired response scenario for each risk level by setting the risk level for the generated response scenario through the creation screen 1300 . The administrator may complete generation of the corresponding scenario by selecting the save button 1350 , and the data security management module 100 may store the generated corresponding scenario. The data security management module 100 may perform a corresponding operation for data security management by applying the corresponding scenario to a file having the same level of risk as the generated corresponding scenario.

That is, the data security management module 100 according to an embodiment of the present disclosure provides a user interface for customizing a corresponding scenario to an administrator, etc., so that the administrator can use group characteristics or data storage system 10 . An appropriate response scenario can be easily created and managed based on the characteristics of files or data.

The present invention described above can be implemented as computer-readable codes on a recording medium in which a program is recorded. The computer-readable recording medium includes all types of recording devices in which data readable by a computer system is stored. Examples of computer-readable media include Hard Disk Drive (HDD), Solid State Disk (SSD), Silicon Disk Drive (SDD), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. includes Accordingly, the above detailed description should not be construed as restrictive in all respects but as exemplary. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the equivalent scope of the present invention are included in the scope of the present invention.

Claims (10)

In the data security management method of the data storage system in the group,
detecting files being created, altered, or accessed in the data storage system;
acquiring a corresponding scenario corresponding to the detected risk level from among a plurality of corresponding scenarios based on the detected risk level for the detected file; and
performing a data security management operation on the detected file by performing a plurality of response methods included in the acquired response scenario according to a set processing order,
The data security management method,
receiving a generation request or a change request of a corresponding scenario from a terminal;
in response to the received request, providing an interface for generating or changing a corresponding scenario to the terminal;
receiving, based on the provided interface, an input for generating or changing a corresponding scenario in which a plurality of corresponding ways and a processing order of the plurality of corresponding ways are defined; and
and storing the generated or changed corresponding scenario based on the received input.
How to manage data security.
According to claim 1,
The plurality of corresponding scenarios are provided for each risk level of files existing in the data storage system,
How to manage data security.
According to claim 1,
Each of the plurality of correspondence methods is defined as a processing operation for data security management of a file,
wherein the processing action includes at least one of deletion, movement, copying, encryption, de-identification, and notification to an administrator of a file;
How to manage data security.
delete According to claim 1,
The interface includes a screen output through the display of the terminal,
The screen includes a selection area for selecting a plurality of corresponding methods, a corresponding scenario area for setting and displaying the selected corresponding methods and processing order, and a detailed setting area for setting conditions for each of the selected corresponding methods,
How to manage data security.
According to claim 1,
The data security management method,
determining, based on the sensitive data included in the file, the sensitive data or at least one associated file having data associated with the sensitive data; and
Further comprising the step of providing information on the determined at least one related file,
How to manage data security.
7. The method of claim 6,
The step of performing a data security management operation for the detected file includes:
checking a file related to the detected file; and
Using a corresponding scenario for the detected file, further comprising the step of performing a data security management operation for the identified related file,
How to manage data security.
According to claim 1,
The data security management method,
evaluating the risk of each of the files existing in the data storage system using an artificial intelligence model that learns the risk of a keyword or pattern included in the files; and
Based on the risk assessed for each of the files, further comprising the step of measuring and providing a security risk to the data storage system,
How to manage data security.
9. The method of claim 8,
The step of evaluating the risk is,
When the URL is included in the file, the risk of the file is evaluated by reflecting the risk to the URL,
How to manage data security.
A computer-readable recording medium recording a program for performing the data security management method according to any one of claims 1 to 3, 5 to 9.

Images