KR20110130203A - IT security risk management apparatus and method - Google Patents

Abstract

An IT security risk management apparatus and method are disclosed. Through the analysis of attack paths for vulnerabilities of actual IT assets, the T security risk management device for efficiently managing security risks of IT assets includes network configuration information collection unit, vulnerability information collection unit, and attack path analysis. Contains wealth. The network configuration information collecting unit collects network configuration information including the configuration type of the network for which IT security risk management is to be performed, the type of network devices configuring the network, and the IP address of the network devices. It collects vulnerability information included in IT assets, and the attack path analysis unit links network configuration information and vulnerability information based on IP address to access each of the vulnerabilities included in IT assets from external attackers. Analyzes and excludes vulnerabilities inaccessible to external attackers. As a result, by analyzing the attack path of the threat against the vulnerabilities of the IT assets and excluding the inaccessible vulnerabilities by the external attacker, the number of managed vulnerabilities can be reduced, thereby reducing the security investment cost. In addition, by analyzing the attack path, the threat probability of the vulnerability can be set, and the actions taken according to the set rank can be minimized, thereby minimizing the possibility of the IT incident and the impact of the incident.

Description

Apparatus and method for managing IT security risk}

The present invention relates to an apparatus and method for managing IT security risks, and more particularly, to an apparatus and method for efficiently managing security risks of IT assets through analysis of attack paths for vulnerabilities of actual IT assets. It is about.

Many IT assets (software, operating systems, etc.) used by many companies now have security vulnerabilities from vendor launches, and statistics show that about 1,000 lines of software code contain about five potential security vulnerabilities. It is known to be released.

These vulnerabilities are targeted by malware and malicious hackers, such as the 1.25 Internet Catastrophe and the 77 DDoS Catastrophe (recently in the form of "Zero-day threats", where the attack takes place as soon as the vulnerability is known).

According to statistics such as CERT and CSI / FBI, these vulnerabilities are found continuously, and as IT assets are diversified and complicated, they are steadily increasing (20-50% annually), and the damage costs are also increasing. .

As a result, IT security risk management has emerged as an important issue across enterprise operations, and efforts are being made to reduce such damage by installing various security solutions.

However, despite the deployment of security solutions, most companies still see an increasing proportion of malicious code or security breaches as security vulnerabilities in IT assets increase. It is focused, and there are many challenges to effectively managing the risks of an entire IT asset.

At present, the number of business applications in use in the enterprise ranges from tens to hundreds, and thousands of servers, routers, firewalls, and intrusion prevention systems are used, resulting in tens of thousands of security vulnerabilities in many IT assets. And can be seen.

In addition, as well as security vulnerabilities existing in current IT assets, more than 10 new vulnerabilities are discovered every day, and the network configuration is constantly changing, so the security vulnerabilities of IT assets cannot be counted accurately. .

Because of this, even if you use a solution called a vulnerability scanner, it simply finds a number of vulnerabilities and simply informs the administrator, so the administrator cannot get any information on what vulnerabilities should be addressed first. Manual analysis from week to months should be performed.

However, even if the analysis is conducted with a large amount of time and cost, it can be considered that it is practically impossible to solve all the security vulnerabilities found. Therefore, even though the vulnerability is managed, the security level is gradually decreasing.

Therefore, it is urgent to provide concrete and clear solutions to reduce the security damage caused by the vulnerability of corporate IT assets.

The present invention has been made to solve such a conventional problem, it is to automatically analyze the attack path of the threat (attacker) for the vulnerabilities of the IT assets to reduce the security risk analysis time, reduce the security investment cost The purpose.

It also aims to minimize the possibility of infringement incidents and the impact of infringement incidents of IT assets by setting the threat probability rankings for vulnerabilities through the attack path analysis and taking actions according to the set ranking.

In order to achieve the above object, the IT security risk management apparatus according to the present invention includes a network configuration information collecting unit, vulnerability information collecting unit, and attack path analysis unit.

The network configuration information collecting unit collects network configuration information including the configuration type of the network for which IT security risk management is to be performed, the type of network devices configuring the network, and the IP address of the network devices. It collects vulnerability information included in IT assets, and the attack path analysis unit links network configuration information and vulnerability information based on IP address to access each of the vulnerabilities included in IT assets from external attackers. Analyzes and excludes vulnerabilities inaccessible to external attackers.

As a result, by analyzing the attack path of the threat against the vulnerabilities of the IT assets and excluding the inaccessible vulnerabilities by the external attacker, the number of managed vulnerabilities can be reduced, thereby reducing the security investment cost. .

In addition, the IT security risk management apparatus according to the present invention may further include an access control policy collector for collecting an access control policy (ACL) that is individually applied to some of the network devices, attack path analysis unit By linking network configuration information, access control policy, and vulnerability information with each other based on IP address, it analyzes whether the external attacker is accessible by the access control policy for vulnerabilities that an external attacker can access. Vulnerabilities that are not accessible by the control policy can be excluded from management.

As a result, even in the case of physically accessible vulnerabilities, the inaccessible vulnerabilities can be additionally excluded from the management target by the access control policy, thereby further reducing the number of managed vulnerabilities.

In addition, the attack path analyzer classifies vulnerabilities that are accessible by an external attacker by access control policy, and classifies vulnerabilities that are directly accessible by an external attacker as directly accessible vulnerabilities. Accessible vulnerabilities can be classified as indirectly accessible vulnerabilities.

As a result, vulnerabilities that can be directly accessed by external attackers can be regarded as having a higher probability of infringement than indirectly accessible vulnerabilities, thereby improving accuracy in setting priority of action.

In addition, the IT security risk management apparatus according to the present invention multiplies the value of the IT asset for the IT asset where the direct or indirectly accessible vulnerabilities are located by multiplying the threat severity (CVSS) of the direct or indirectly accessible vulnerabilities. The business impact analysis unit for analyzing the business impact of the vulnerabilities may further include.

In addition, the IT security risk management apparatus according to the present invention may further include a vulnerability action priority setting unit for setting the action priority of the vulnerabilities by associating and analyzing the business impact on the vulnerabilities that can be directly or indirectly accessed.

This allows you to set the threat likelihood ranking for each vulnerability, taking into account not only the threat severity, but also the value of the IT asset and the path of attack, thereby increasing the accuracy of the action priority and taking action according to the established priority. By doing so, it is possible to minimize the possibility of an infringement incident and the impact of the infringement incident on the IT asset.

In addition, an invention embodying the apparatus in the form of a method is disclosed.

According to the present invention, it is possible to shorten the time of security risk analysis by automatically analyzing the attack path of the threat for the vulnerabilities of the IT assets, reduce the security investment cost, and the possibility of threat to the vulnerability through the attack path analysis. By setting the rankings and taking actions according to the set rankings, it is possible to minimize the likelihood of an infringement incident and the effect of the infringement incident on the IT asset.

1 is a diagram schematically showing an embodiment of an overall network configuration in which an IT security risk management apparatus according to the present invention is installed.
Figure 2 is a block diagram schematically showing an embodiment of the configuration of the IT security risk management apparatus according to the present invention.
3 is a diagram illustrating an attack path analysis process of an external attacker (attack source) in the overall network configuration of FIG.
4 is a flow diagram schematically illustrating one embodiment of an IT security risk management method in accordance with the present invention.
5 is a diagram illustrating an embodiment of collecting vulnerability information for one server.
6 is a flow chart showing in detail the attack path analysis step of FIG.
7 is a diagram illustrating an attack path analysis result and a business impact analysis result;

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. In order to more clearly understand the present invention, the same reference numerals are used for the same components in different drawings.

1 is a diagram schematically showing an embodiment of an overall network configuration in which the IT security risk management apparatus 100 according to the present invention is installed.

The whole network configuration to perform IT security risk management is connected to the external router 1, 2 (310, 320) and the external router 1, 2 (310), which can be an attack source (external attacker). , 320 is connected to the external firewall 400. At this time, the external firewall 400 is included in the internal network 10.

The FTP server 510 and the web server 520 are installed in the DMZ server 500 configured in the external firewall 400, and the external firewall 400 is connected to the internal routers 1 and 2 (610 and 620) again. The internal routers 1 and 2 610 and 620 are connected to the internal firewall 700, and the internal firewall 700 includes a plurality of servers (server 1 810, server 2 820, and server n). 830).

In the overall network configuration of FIG. 1, the IT security risk management apparatus 100 of the present invention includes an internal firewall 700 and a plurality of servers (server 1 810, server 2 820, and server n 830). While in between, it would be desirable to be anywhere within the entire network where IT security risk management of the network can be performed.

2 is a block diagram schematically showing an embodiment of the configuration of the IT security risk management apparatus 100 according to the present invention.

The IT security risk management apparatus 100 according to the present invention includes a network configuration information collecting unit 110, an access control policy collecting unit 120, a vulnerability information collecting unit 130, an attack path analyzing unit 140, and a business impact degree. Analysis unit 150, and vulnerability action priority setting unit 160.

The network configuration information collecting unit 110 is a network mapper. The network configuration information collecting unit 110 is a network mapper including a configuration form of a network for which IT security risk management is to be performed, types of network devices configuring the network, and IP addresses of the network devices. Collect information.

Types of network devices may include routers, servers, PCs, firewalls, and switches.

The access control policy collector 120 collects access control policies (ACLs) that are individually applied to some of the network devices.

That is, based on the network configuration information collected by the network configuration information collecting unit 110, the access control policy that is individually applied to firewalls and routers among network devices by logging in with credentials such as SSH and Telnet. Collect it.

The vulnerability information collecting unit 130 collects vulnerability information included in the IT asset in the network.

The vulnerability information collection unit 130 may be a vulnerability scanner that finds and displays all the vulnerabilities of the network device including the IT asset before the attacker finds the vulnerability.

At this time, the IT asset refers to all the software (eg, database, operating system, applications, etc.) used by the enterprise, and is included in the network device having the IP address, so that the vulnerabilities found in the vulnerability information collecting unit 130 correspond to each. Matches the IP address of the IT asset being created (the IP address of the network device on which the IT asset is installed).

The attack path analyzing unit 140 links network configuration information, access control policy, and vulnerability information with each other based on an IP address, and analyzes an attack path from an external attacker for each of the vulnerabilities of the IT asset.

Attack path analysis unit 140 may analyze the attack path in the following process.

First, using the network configuration information and vulnerability information, it analyzes the accessibility of the external attacker for each of the found vulnerabilities, and excludes the vulnerabilities that are not accessible by the external attacker.

(However, if the vulnerability is exploitable (accessible) by an internal user or by malicious code, the vulnerability is considered valid.)

Next, by linking the network configuration information, vulnerability information, and access control policy with each other based on the IP address, the vulnerability that can be accessed by an external attacker can be accessed by an external attacker by an access control policy set on each of the network devices. It analyzes whether it is recognized and excludes vulnerabilities that are not accessible by external attackers by the access control policy (except that external access is not possible even if the IT asset has the vulnerability).

That is, the vulnerabilities found through the two processes described above (accessibility analysis by external attacker and accessibility analysis by access control policy) are 'externally accessible (included in the management target)' and 'externally inaccessible (targeted for management). Excluded from).

Then, it analyzes whether the external attacker can directly or indirectly access the vulnerabilities classified as 'externally accessible'.

Directly accessible vulnerabilities refer to vulnerabilities that an attacker can directly access to the vulnerability from outside (ie, an external attacker-> the vulnerability).

Also, indirectly accessible vulnerabilities mean that vulnerabilities cannot be accessed directly by an attacker from outside, but are accessible through vulnerabilities of other internal devices (servers, etc.) (ie, external attackers-> vulnerabilities of other devices). -> The vulnerability).

 Vulnerabilities that can be directly accessed by external attackers can be analyzed as having a high probability of infringement, and vulnerabilities that can be indirectly accessed by external attackers can be analyzed as being relatively low.

In other words, the analysis result of the attack path may be classified into found vulnerabilities as 'externally inaccessible (excluded from management)', 'external direct access', and 'external indirectly accessible'.

FIG. 3 is a diagram illustrating an attack path analysis process of an external attacker (attack source) in the overall network configuration of FIG. 1.

Referring to FIG. 1 and FIG. 3, the above-described attack path analysis process will be described. The network configuration information collecting unit 110 may include a configuration form of a network and types of network devices (external router 1 310 and external router 2 320). , An external firewall 400, an internal router 1 610, an internal router 2 630, and an attack target (comprised of server 1 810, server 2 820, or server n 830), each of which Collect network configuration information such as IP addresses corresponding to network devices.

The access control policy collector 120 may apply an access control policy applied to each of the external router 1 310, the external router 2 320, the external firewall 400, the internal router 1 610, and the internal router 2 630. Collect it.

At this time, an access control device such as an external router 1 (310), an external router 2 (320), an external firewall (400), an internal router 1 (610), or an internal router 2 (630) is referred to as an "IP address, protocol (TCP or UDP), port number "to control (allow or deny) access from outside to inside.

Therefore, referring to the example of 'Access Control Policy x Allow', 'Access Control Policy z Allow', or 'Access Control Policy y Allow' of FIG. 3, "TCP any * any 80 Allow", "TCP any * any 25 "Deny". "TCP any * any 80 Allow" means a policy such as allowing access to 80 (web server) port of any internal IP address (any) with any port (*) at any external IP address (any). , "TCP any * any 25 Deny" means a policy such as allowing access to port 25 (email server) of any internal IP address (any) with any port (*) on any external IP address (any). .

The vulnerability information collecting unit 130 collects vulnerability information on IT assets included in the attack target (server 1 810, server 2 820, or server n 830).

The attack path analyzing unit 140 associates network configuration information, access control policy, and vulnerability information with each other based on the IP address, thereby attacking the target (server 1 810, server 2 820, or server n 830). For each of the vulnerabilities for the IT assets that are included), if the external attack source (external attacker, 200) such as the Internet 200 is accessible, then the external attack source 200 is the external router 1 ( 310 or whether the vulnerability is accessible by the access control policy of the external router 2 (320).

If the external attack source 200 is accessible to the vulnerability by the access control policy of the external router 1 310 or the external router 2 320, the external attack source 200 is the next network device, the external firewall 400. Analyzing whether the vulnerability is accessible by the access control policy of the external attack source, if the external attack source 200 is accessible to the vulnerability by the access control policy of the external firewall 400, the external attack source 200 is the internal router It is analyzed whether the vulnerability is accessible by the access control policy of 1 (610) or internal router 2 (630).

If the external attack source 200 can access the vulnerability by the access control policy of the internal router 1 610 or the internal router 2 630, the vulnerability may be directly or indirectly accessed by the external attack source 200. Analyze whether this is a possible vulnerability.

If the external attack source 200 can access the vulnerability through a vulnerability in another internal server, the vulnerability can be classified as a vulnerability that can be accessed indirectly.

In the case of vulnerabilities that can be directly accessed by the external attack source 200, the incidence of infringement is likely to be high. can do.

Referring back to FIG. 2, the business impact analysis unit 150 determines the degree of value of the IT asset for the IT asset where the vulnerabilities accessible by the external attacker are directly accessible or indirectly accessible, and the vulnerabilities directly accessible or indirectly accessible by the external attacker. The business impact of each vulnerability can be analyzed by multiplying their threat severity (CVSS).

All vulnerabilities are quantitatively expressed in standardized threat severity. Threat severity is an international standard value expressed as a quantified value (1 to 10) of the magnitude of the damage that can occur when the vulnerability is breached.

 Multiply the value of the IT asset where the vulnerability is found by the threat severity to analyze the business impact.

(I.e. business impact = value of IT assets × threat severity)

At this time, the value of the IT asset can be seen as the sum of the cost of recovery in case of theft, failure or damage of information, and the cost of the loss in case of inability to perform work, and input the preset value or directly input by the administrator. Can be.

The vulnerability action priority setting unit 160 may set the action priority of the vulnerabilities by associating and analyzing the business impact on vulnerabilities that are indirectly accessed and directly accessible by an external attacker.

Action priorities can be expressed as quantitative values (exact figures) or qualitative values (very high, high, moderate, low).

Automating the analysis of attack paths by external attackers for the vulnerabilities of IT assets as described above can dramatically reduce the time of security risk analysis and reduce the number of managed vulnerabilities, thereby reducing the security investment cost. (Unless the value of an IT asset is entered directly by the manager).

In addition, through attack path analysis and business impact analysis, it is possible to set the probability of infringement (= action priority) for highly accurate vulnerabilities.

In addition, by taking appropriate measures to mitigate the serious threats of core IT assets according to the established ranking of possible infringements, the possibility of infringement incidents and the impact of infringement incidents on IT assets can be minimized. Significantly improve the security risk management process.

In addition, problems found in traditional IT security risk management, uncovered vulnerabilities are unmanaged, preventable security incidents occur, and unnecessary resource waste invested in non-core assets (eg, non-core assets). Excessive patching) problems can be solved.

4 is a flowchart schematically showing an embodiment of an IT security risk management method according to the present invention.

First, network configuration information including a configuration form of a network to which IT security risk management is to be performed, types of network devices configuring the network, and IP addresses of the network devices are collected (S100).

Based on the collected network configuration information, after collecting the access control policy applied individually to some devices (firewall and router) among the network devices (S200), selected (or all) IT assets in the network are included. Collecting vulnerability information (S300).

(Step S200 may be performed at any stage before step S420 of FIG. 6 described later.)

If the selected IT asset is installed in a server having an IP address of 192.1.11.123, all vulnerability information of all IT assets installed in 192.1.11.123 are collected as shown in FIG.

5 is a diagram illustrating an embodiment of collecting vulnerability information for one server.

In Figure 5 it can be seen that a total of 20 vulnerabilities have been found, it can be seen that the dark colored vulnerabilities are vulnerabilities of high threat severity.

The threat severity of the selected vulnerability is 6, which is normal, and we can see that it is waiting on TCP port 3389.

(In Figure 5, the value of IT assets is not reflected, and only threat severity is applied and classified, so the accuracy of action priority is low.)

Referring back to FIG. 4, the collected network configuration information, access control policy, and vulnerability information are linked to each other based on the IP address to analyze an attack path from an external attacker for each of the vulnerabilities of the IT asset (S400). The attack path analysis step S400 will be described in detail with reference to FIGS. 6 and 7.

FIG. 6 is a flowchart illustrating an attack path analysis step S400 of FIG. 4 in detail, and FIG. 7 is a view showing an attack path analysis result and a business impact analysis result.

For each of the vulnerabilities from the collected vulnerability information, it is analyzed whether the corresponding vulnerability is accessible to an external attacker (S410).

If the external attacker is an inaccessible vulnerability, the vulnerability is regarded as an externally inaccessible vulnerability and is excluded from management (S412). If the external attacker is an accessible vulnerability, the external attacker has an access control policy for the vulnerability. It is analyzed whether or not accessible by (S420).

If the external attacker is accessible but cannot be accessed by the access control policy, the vulnerability is regarded as an externally inaccessible vulnerability and is excluded from management (S412), and the external attacker is accessible and is also accessed by the access control policy. If it is a possible vulnerability, it is analyzed whether an external attacker can directly access the vulnerability (S430).

If the external attacker is a directly accessible vulnerability, the vulnerability is regarded as an externally accessible vulnerability (S432). If the external attacker is not directly accessible, if the external attacker can access the vulnerability through a vulnerability in another IT asset. The vulnerability is considered to be indirectly accessible from outside (S434).

That is, as a result of the attack path analysis step (S400), the collected vulnerabilities as shown in FIG. 7 may be classified into 'externally inaccessible', 'externally accessible directly', and 'externally indirectly accessible'. Vulnerabilities classified as "inaccessible" can be excluded from management, and vulnerabilities classified as "externally accessible" can be analyzed as having a higher risk of accidents than those classified as "externally indirectly accessible". .

Referring back to Figure 4, when the attack path analysis step (S400) for the vulnerabilities is finished, the business impact analysis for the vulnerabilities is performed (S500).

The business impact is the value of the IT asset on the IT asset where the vulnerabilities classified as 'externally accessible' and 'externally accessible', as well as 'externally accessible' and 'externally accessible'. It can be analyzed by multiplying the threat severity (CVSS) of the classified vulnerabilities, and can be expressed as a quantitative value (exact value) or as a qualitative value (very high, high, medium, low) as shown in FIG. .

In this case, the analysis of the business impact may be analyzed for vulnerabilities classified as 'external direct access' and 'external indirect access', as described above, but may be analyzed for all collected vulnerabilities.

Finally, business priorities are linked and analyzed for vulnerabilities classified as 'external direct access' and 'external indirect access' (S600).

That is, referring back to FIG. 7, if there are 20 vulnerabilities of the server containing the IT asset, the general vulnerability scanner simply lists 20 vulnerabilities, so the administrator must manually analyze the listed vulnerabilities in the conventional method. did.

In this case, 20 vulnerabilities were found per server, so in a large network with 1,000 servers, the total number of vulnerabilities was 20,000, which would take a lot of time and effort if all the work was done by hand.

However, if the present invention is applied, the attack path analysis-business impact analysis is set as a vulnerability to be taken first priority when the vulnerability is' external direct access-very high ', and' external indirect access-- If the vulnerability is low, it can be set as the last vulnerable action, so only the two vulnerabilities, ie, external direct access-very high, need to be prioritized.

In other words, you need to take only 2 vulnerabilities per server and a total of 2,000 vulnerabilities, which can reduce management costs by about 90%.

(The weights of the attack path analysis and business impact analysis may vary depending on the administrator's settings, so the action priority for the other cases except 'direct externally accessible-very high' and 'externally accessible externally-low' It can vary depending on the weight you set.)

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and may be implemented in the form of a carrier wave (for example, transmission via the Internet) . The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

10 internal network
100 IT security risk management device
110 Network Configuration Information Collector
120 Access Control Policy Collector
Vulnerability Information Collection Unit
140 Attack Path Analysis
150 Business Impact Analysis Unit
160 Vulnerability Action Priority Settings
200 internet
310 external router 1
320 external router 2
400 external firewall
500 DMZ Server
510 FTP server
520 web server
610 internal router 1
620 internal router 2
700 internal firewall
802 IT Assets
810 server 1
820 server 2
830 server n

Claims (11)

A network configuration information collecting unit configured to collect network configuration information including a configuration form of a network to which IT security risk management is to be performed, types of network devices configuring the network, and IP addresses of the network devices;
A vulnerability information collection unit for collecting vulnerability information included in the IT asset in the network; And
The network configuration information and the vulnerability information are linked to each other based on the IP address to analyze whether each of the vulnerabilities included in the IT asset is accessible from an external attacker, and the vulnerabilities inaccessible to the external attacker. Attack path analysis unit to exclude from the management target; IT security risk management apparatus comprising a. The method of claim 1,
An access control policy collector configured to collect an access control policy (ACL) that is individually applied to some of the network devices; Further comprising:
The attack path analysis unit,
The network configuration information, the access control policy, and the vulnerability information are linked to each other based on the IP address to determine whether the external attacker is accessible by the access control policy for vulnerabilities accessible by the external attacker. And analyzing and excluding vulnerabilities inaccessible by the external attacker by the access control policy from the management target. The method of claim 2,
The attack path analysis unit,
For vulnerabilities that are accessible by the external attacker, the vulnerabilities directly accessible by the external attacker are classified as directly accessible vulnerabilities, and the external attacker is accessible through vulnerabilities of other internal network devices. An IT security risk management device, which classifies vulnerabilities as indirectly accessible vulnerabilities. The method of claim 3, wherein
Analyzing the business impact of each vulnerability by multiplying the value of the IT asset for the IT asset where the direct or indirectly accessible vulnerabilities are located and the threat severity (CVSS) of the direct or indirectly accessible vulnerabilities Business impact analysis unit; IT security risk management device further comprising. The method of claim 4, wherein
A vulnerability action priority setting unit that establishes an action priority of the vulnerability by linking and analyzing the business impact with respect to the direct access or the indirectly accessible vulnerability; IT security risk management device further comprising. (a) collecting network configuration information including a configuration form of a network to which IT security risk management is to be performed, types of network devices configuring the network, and IP addresses of the network devices;
(c) collecting vulnerability information included in IT assets in the network; And
(d) linking the network configuration information and the vulnerability information with each other based on the IP address, analyzing whether each of the vulnerabilities included in the IT asset is accessible from an external attacker, and accessing the external attacker; Excluding impossible vulnerabilities from management; IT security risk management method comprising a. The method of claim 6,
Between steps (a) and (c),
(b) collecting an access control policy (ACL) that is individually applied to some of the network devices; Further comprising:
After the step (d)
(e) linking the network configuration information, the access control policy, and the vulnerability information with each other based on the IP address to access vulnerabilities accessible to the external attacker by the external attacker by the access control policy; Analyzing whether it is possible and excluding vulnerabilities that are not accessible by the external attacker by the access control policy from being managed; IT security risk management method characterized in that it further comprises. The method of claim 7, wherein
After step (e),
(f) direct access to vulnerabilities accessible to the external attacker by the access control policy and direct access to vulnerabilities directly accessible by the external attacker to the vulnerabilities accessible by the external attacker to the access control policy. Classifying the vulnerabilities into indirectly accessible vulnerabilities, wherein the external attackers can access vulnerabilities accessible through vulnerabilities of other internal network devices; IT security risk management method characterized in that it further comprises. The method of claim 7, wherein
After step (f),
(g) multiply each of the vulnerabilities by multiplying the value of the IT asset for the IT asset in which the direct or indirect accesses are located by the threat severity (CVSS) of the direct or indirectly accessible vulnerabilities; Analyzing their business impact; IT security risk management method characterized in that it further comprises. The method of claim 9,
After step (g),
(h) establishing an action priority of the vulnerabilities by associating and analyzing the business impact with respect to the direct or indirectly accessible vulnerabilities; IT security risk management method characterized in that it further comprises. A recording medium which can read the IT security risk management method according to any one of claims 6 to 10, and which is recorded as executable program code.

Images