KR102330404B1 - Method And Apparatus for Diagnosing Integrated Security - Google Patents

Abstract

An integrated security diagnosis method and device are disclosed. In the present embodiment, a plurality of diagnostic tools are used to periodically diagnose diagnostic items set by default in the company internal/external network, and at the same time to diagnose additional diagnostic items aperiodically, and diagnostic information is collected to extract and automatically report vulnerabilities based on the analysis results, in the integrated security diagnosis method and device.

Description

Method And Apparatus for Diagnosing Integrated Security

One embodiment of the present invention relates to an integrated security diagnosis method and apparatus.

The content described below merely provides background information related to the present embodiment and does not constitute the prior art.

With the development of information industry and technology, various types of network systems suitable for different user environments are being developed. In modern society, various devices and systems, such as home network devices and network robots, that are closely related to human life, are connected through networks to provide various services.

In general, a company's internal network is equipped with security equipment or a security control system to counter cyber attacks. However, threats from web hacking, web shell, DDoS, malicious code, APT, and insider attacks are continuously increasing in recent years, and verification of the security control system is required to maintain network security.

In order to diagnose the security of an IT system, it is necessary to analyze various items. In the case of DB vulnerability diagnosis, for example, it is necessary to analyze items such as blocking unlimited login attempts, setting password complexity, maximum password usage period, and limiting DBA authority. In the prior art, in diagnosing the security of an IT system, security diagnosis was performed by collecting and analyzing information necessary for security diagnosis from an agent installed in a system to be diagnosed, and then transmitting the analysis result to a security diagnosis server.

In the conventional case, it is difficult to diagnose the overall security control level of the network, and there is a problem in that it is impossible to self-diagnose the security control system without professional knowledge about security.

In this embodiment, a plurality of diagnostic tools are used to periodically diagnose the diagnostic items set by default in the internal and external networks of the company, and at the same time to diagnose additional diagnostic items aperiodically, collect diagnostic information and extract vulnerabilities based on the analysis results. An object of the present invention is to provide an integrated security diagnosis method and apparatus for automatic reporting.

According to an aspect of the present embodiment, there is provided a first diagnostic unit comprising: a first diagnostic unit configured to generate first diagnostic information for diagnosing a diagnostic item set as a default for a plurality of diagnostic targets at a preset diagnostic cycle; a second diagnosis unit generating second diagnosis information obtained by diagnosing additional diagnosis items with respect to the plurality of diagnosis targets at a different diagnosis cycle than that of the first diagnosis unit; a threat information diagnosis unit generating scanning diagnosis information by scanning the plurality of diagnosis target plug-ins; and an automatic report for generating vulnerability analysis result information by analyzing the first diagnosis information, the second diagnosis information, and the scanning diagnosis information, and comparing the security levels of the plurality of diagnosis targets with each other based on the vulnerability analysis result information It provides an integrated security diagnosis apparatus comprising a vulnerability management unit that reports the .

As described above, according to this embodiment, a plurality of diagnostic tools are used to periodically diagnose the diagnostic items set as defaults in the internal/external network of the company, aperiodically diagnose additional diagnostic items, and collect and analyze diagnostic information. It has the effect of automatically reporting vulnerabilities by extracting vulnerabilities based on the results.

1 is a block diagram schematically showing an integrated security diagnosis apparatus according to the present embodiment.
2 is a block diagram schematically showing the threat information collection tool according to the present embodiment.
3A to 3F are diagrams illustrating a method of collecting corporate IT infrastructure information according to the present embodiment.
4 is a diagram illustrating a method of collecting corporate employee information according to the present embodiment.
5A and 5B are diagrams illustrating a data association analysis method according to the present embodiment.
6 is a diagram illustrating detailed management of a management target and a subject according to the present embodiment.
7A and 7B are diagrams illustrating vulnerability check and action status management according to the present embodiment.
8 is a view showing vulnerability check schedule management according to the present embodiment.
9 is a diagram illustrating automation of diagnosis start and end reporting according to the present embodiment.
10 is a diagram illustrating automatic diagnosis of new vulnerabilities according to the present embodiment.
11 is a diagram illustrating automatic trace generation of a diagnosis result according to the present embodiment.

Hereinafter, this embodiment will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically showing an integrated security diagnosis apparatus according to the present embodiment.

The integrated security diagnosis apparatus 100 provides a system for analyzing a hacking list for each company. For example, the integrated security diagnosis apparatus 100 may collect and analyze information from a specific company server (eg, company A) using a diagnosis tool, and may analyze a security risk specific to a specific company server (company A). The integrated security diagnosis apparatus 100 collects information (files, documents, etc. attached to an e-mail) by basically scrolling on the web (homepage, in-house e-mail, etc.) of a company's intra network using a diagnosis tool. The integrated security diagnosis apparatus 100 generates and outputs a level of security risk suitable for each company by analyzing the collected information using a diagnosis tool.

The integrated security diagnosis apparatus 100 according to the present embodiment provides an optimal solution for automatically diagnosing and managing a plurality of vulnerabilities and threats to be managed in real time. For example, the integrated security diagnosis apparatus 100 provides a system for comparing and managing the security of a plurality of business sites and partner companies of company A in real time by being applied to a plurality of business sites and partner companies of company A, which is a diagnosis target.

The integrated security diagnosis apparatus 100 compares and manages security levels of a plurality of domestic and overseas business sites of a specific company to be diagnosed. The integrated security diagnosis apparatus 100 detects and outputs the status of the vulnerability action of the diagnosis target in real time. The integrated security diagnosis apparatus 100 automatically diagnoses some vulnerabilities of a diagnosis target.

The integrated security diagnosis apparatus 100 generates an automatic report on the vulnerability of the diagnosis target and reports it daily and weekly. The integrated security diagnosis apparatus 100 uses automatic mailing for a diagnosis target to efficiently perform repetitive tasks. The integrated security diagnosis apparatus 100 enables automatic storage of diagnosis traces and compliance response.

The integrated security diagnosis apparatus 100 analyzes the risk level by analyzing the data collected by scrolling the web for the diagnosis target. The integrated security diagnosis apparatus 100 performs risk scoring by analyzing whether the collected information is dangerous information or non-risk information.

The integrated security diagnosis apparatus 100 performs scoring according to various information including information scrolled on the web, domain information, and the like using the second diagnosis tool. The integrated security diagnosis apparatus 100 outputs whether information with high risk or low risk according to scoring using the second diagnostic tool. The integrated security diagnosis apparatus 100 further analyzes low-risk information using the second diagnostic tool to determine information requiring management among low-risk information.

The integrated security diagnosis apparatus 100 according to the present embodiment includes a first diagnosis unit 110 , a second diagnosis unit 120 , a threat information diagnosis unit 130 , and a vulnerability management unit 140 . Components included in the integrated security diagnosis apparatus 100 are not necessarily limited thereto.

Each component included in the integrated security diagnosis apparatus 100 may be connected to a communication path that connects a software module or a hardware module inside the device, and may operate organically with each other. These components communicate using one or more communication buses or signal lines.

Each component of the integrated security diagnosis apparatus 100 shown in FIG. 1 means a unit for processing at least one function or operation, and may be implemented as a software module, a hardware module, or a combination of software and hardware.

The first diagnosis unit 110 periodically diagnoses a specific company server using the first diagnosis tool. The first diagnostic unit 110 selects a host, a network, a system, and an application of a specific company as diagnostic targets. The first diagnostic unit 110 generates first diagnostic information for diagnosing a diagnostic item set as a default for a plurality of diagnostic targets at a preset diagnostic cycle.

The first diagnostic unit 110 periodically performs diagnostics for each host, network, system, and application of a specific company by using the first diagnostic tool. The first diagnosis unit 110 performs intrusion accident diagnosis and vulnerability diagnosis by using the intrusion accident diagnosis tool and vulnerability diagnosis tool provided for the diagnosis target.

The first diagnostic tool is a basic diagnostic tool and refers to a tool for diagnosing a diagnostic item set as a default. The first diagnosis tool periodically performs diagnosis on a preset diagnosis item.

The first diagnosis unit 110 selects a host, a network, a system, and an application as a plurality of diagnosis targets. The first diagnostic unit 110 periodically performs anomaly diagnosis, intrusion accident diagnosis, and vulnerability diagnosis using the host, network, system, and anomaly symptom diagnosis tool, intrusion accident diagnosis tool, and vulnerability diagnosis tool provided for each of the applications. The performed first diagnostic information is generated.

The second diagnosis unit 120 diagnoses the diagnosis target by using an additional second diagnosis tool different from the first diagnosis tool. The second diagnosis unit 120 additionally selects the Dark Web as the diagnosis target as well as the host, network, system, and application of a specific company that is the same diagnosis target as the first diagnosis unit 110 . The second diagnosis unit 120 generates second diagnosis information obtained by diagnosing additional diagnosis items for a plurality of diagnosis targets at a different diagnosis cycle than that of the first diagnosis unit 110 .

The second diagnosis unit 120 generates second diagnosis information by performing diagnosis on a plurality of diagnosis objects using additional diagnosis tools different from those of the first diagnosis unit 110 .

The second diagnostic unit 120 uses the second diagnostic tool to not only host, network, system, and application, which are the same diagnostic targets as the first diagnostic tool, but also information uploaded or published on the dark web (eg, company business description data). to collect The second diagnosis unit 120 aperiodically performs additional diagnosis for each host, network, system, and application of a specific company by using the second diagnosis tool. The second diagnostic unit 120 includes a Linux OS anomaly detection tool, a WIN OS anomaly detection tool, and a network anomaly detection tool.

The second diagnosis tool refers to a tool that performs diagnosis aperiodically. When a continuously detected vulnerability is found as a result of performing the additional diagnosis, the second diagnostic tool may request that the first diagnostic tool periodically diagnose the corresponding vulnerability. In other words, when the second diagnostic tool detects the same vulnerability more than a preset number of times whenever additional diagnostics are performed, the second diagnostic tool sets the detection frequency of the security risk for the vulnerability to be high in the first diagnostic tool. You may be asked to check periodically.

When a security critical vulnerability is detected as a result of performing the additional diagnosis, the second diagnostic tool may request that the first diagnostic tool diagnose the vulnerability. In other words, when a vulnerability critical to security is detected as a result of performing additional diagnostics, the second diagnostic tool periodically diagnoses the vulnerability in the first diagnostic tool in order to set a high frequency of detection of security risks for the vulnerability. you can request

The execution cycle of the first diagnostic tool and the second diagnostic tool can be set differently. In other words, the diagnosis frequency of the first diagnosis tool can be set to be high by setting the diagnosis period to be shorter than the preset threshold period. The diagnosis period of the second diagnosis tool may be set longer than a preset threshold period to set a lower diagnosis frequency. A security risk level suitable for each company is generated and output by comparing the diagnosis result diagnosed by the first diagnosis tool with the diagnosis result diagnosed by the second diagnosis tool.

The diagnosis cycle of the first diagnosis unit 110 is set shorter than the preset threshold cycle to have a high diagnosis frequency, and the diagnosis cycle of the second diagnosis unit 120 is set longer than the preset threshold cycle to have a low diagnosis frequency.

The threat information diagnosis unit 130 includes a threat information collection tool, and generates scanning diagnosis information by scanning a plurality of diagnosis target plug-ins. The threat information diagnosis unit 130 generates scanning information by tracking the degree of risk for a plurality of diagnosis target plug-ins.

The vulnerability management unit 140 stores the first diagnosis information received from the first diagnosis unit 110 , the second diagnosis information received from the second diagnosis unit 120 , and the scanning diagnosis information received from the threat information diagnosis unit 130 . Analyze and generate vulnerability analysis result information. The vulnerability management unit 140 reports an automatic report comparing the security levels of a plurality of diagnostic targets based on the vulnerability analysis result information at a preset cycle (daily, weekly).

The vulnerability management unit 140 compares the first diagnostic information, the second diagnostic information, and the scanning diagnostic information for a plurality of diagnostic targets, and also outputs a security risk for each diagnostic item.

When the same vulnerability is continuously detected more than a preset number of times or a critical vulnerability is detected based on the second diagnostic information, the vulnerability management unit 140 sets the detection frequency of the security risk for the vulnerability to be high. The vulnerability is added to the default diagnosis items of the first diagnosis unit 110 so that the first diagnosis unit 110 diagnoses the vulnerability at a preset diagnosis cycle.

The vulnerability management unit 140 collects IT infrastructure information from the first diagnosis information, the second diagnosis information, and the scanning diagnosis information. The vulnerability management unit 140 extracts sub domain and IP range information included in the IT infrastructure information. The vulnerability management unit 140 converts the IP range into GPS coordinates and displays the sub-domain at the corresponding coordinates on the map. The vulnerability management unit 140 outputs vulnerability analysis result information for each sub-domain.

The vulnerability management unit 140 maps a port, server information, language used, and whether or not a security solution is used based on the sub-domain included in the IT infrastructure information, and outputs the map along with the vulnerability analysis result information. The vulnerability management unit 140 maps and outputs the plug-in information extracted from the scanning diagnosis information together with the vulnerability analysis result information.

The vulnerability management unit 140 collects open files from the first diagnosis information, the second diagnosis information, and the scanning diagnosis information. The vulnerability management unit 140 checks the exposure information of the open file, sets the risk of the file exposed in a form other than the public shared file (File) to be high, and generates vulnerability analysis result information.

The vulnerability management unit 140 collects information exposed in the dark web from the second diagnosis information. The vulnerability management unit 140 sets a high degree of risk to information exposed in the dark web, and generates vulnerability analysis result information.

The vulnerability management unit 140 collects information found from the second diagnosis information by using a preset search engine. The vulnerability management unit 140 creates vulnerability analysis result information after discovering a vulnerability using a Structured Query Language Injection Attack based on a URL and a domain account among information retrieved using a preset search engine. .

The vulnerability management unit 140 collects crawled data from the second diagnostic information, examines whether the crawled data is hacked, sets a high risk for the data for which hacking is confirmed, and generates vulnerability analysis result information. .

The vulnerability management unit 140 collects employee exposure information from the second diagnosis information. The vulnerability management unit 140 extracts the company email, name, and phone number included in the employee exposure information. The vulnerability management unit 140 extracts an external social network service account that is mapped to a company email, name, and phone number. The vulnerability management unit 140 examines whether an external social network service account is hacked, sets a high degree of risk for data for which hacking is confirmed, and generates vulnerability analysis result information.

The vulnerability management unit 140 maps the inspection target system, inspection target URL, inspection status, management subject, service inspection plan, and expected completion date when comparing the security levels of a plurality of diagnosis targets with each other based on the vulnerability analysis result information, and The security level is output by star, by diagnosis target, and by service management subject.

The vulnerability management unit 140 compares the security levels of a plurality of diagnostic targets based on the vulnerability analysis result information, the overall management target, the vulnerability diagnosis order, the diagnosis date, the presence or absence of measures, the presence or absence of additional implementation check completion, the vulnerability by URL, and the diagnosis Now, whether to take action, the implementation rate according to the action plan, and whether to check the implementation are mapped and output.

When comparing the security levels of a plurality of diagnostic targets based on the vulnerability analysis result information, the vulnerability management unit 140 maps and outputs diagnostic items, whether vulnerabilities are found, risk, residual cases, service operation personnel, and implementation action history.

The vulnerability management unit 140 generates and outputs an entire schedule plan including a diagnosis target for vulnerability analysis result information, a schedule for a diagnosis, a schedule status based on a diagnosis target, and a schedule status based on a diagnosis target.

When starting the inspection based on the vulnerability analysis result information, the vulnerability management unit 140 automatically mails the inspection start mail to the person in charge email collected from the first diagnosis information, the second diagnosis information, and the scanning diagnosis information. When the inspection is completed, the vulnerability management unit 140 automatically mails a vulnerability summary report and inspection completion mail for the vulnerability analysis result information.

The vulnerability management unit 140 performs automatic diagnosis of newly released vulnerabilities. The vulnerability management unit 140 automatically attaches a screen shot of the inspection result and the vulnerability summary report performed on the vulnerability analysis result information.

2 is a block diagram schematically showing the threat information collection tool according to the present embodiment.

The threat information collection tool included in the threat information diagnosis unit 130 automatically collects information disclosed from a plurality of business sites and partner servers included in the diagnosis target. The threat information collection tool analyzes the correlation between the collected information. The threat information collection tool derives and maps threat scenarios based on the analyzed correlation.

The threat information collection tool according to the present embodiment includes a threat information collection unit 210 , a threat information association analysis unit 220 , and a threat scenario derivation unit 230 . Components included in the threat information collection tool are not necessarily limited thereto.

Each component included in the threat information collection tool is connected to a communication path that connects a software module or a hardware module inside the device, and can operate organically with each other. These components communicate using one or more communication buses or signal lines.

Each component of the threat information collection tool shown in FIG. 2 means a unit that processes at least one function or operation, and may be implemented as a software module, a hardware module, or a combination of software and hardware.

The threat information collection unit 210 collects threat information based on Open Source Intelligence (OSINT). The threat information collection unit 210 is threat information, including global cyber threat information, corporate internal integrated information, general web information, deep web information, security vendor threat DB information, and fake site information. to collect

The threat information collection unit 210 collects information disclosed based on OSINT from a plurality of diagnosis targets and generates collection information. The threat information collection unit 210 additionally selects the Dark Web as a diagnosis target in addition to the host, network, system, and application, which are the same diagnosis target as the first diagnosis unit 110 , and information published or uploaded on the dark web. to create collection information. The threat information collection unit 210 generates collection information by collecting web scrolling information, domain information, and upload information scrolled in the web of a diagnosis target.

The threat information association analysis unit 220 performs association analysis based on the collected information. The threat information association analysis unit 220 generates association analysis information by mapping the associated vulnerability information for each of the collected information.

The threat information association analysis unit 220 calculates a level of risk based on the vulnerability information associated with each of the collected information, performs scoring according to the level of risk, and gives a score. The threat information association analysis unit 220 calculates a high score for high-risk information and a low score for low-risk information when performing scoring according to the risk. The threat information association analysis unit 220 extracts information that needs to be managed by performing additional analysis on information having a low risk.

The threat information association analysis unit 220 provides additional information using a link after mapping each of the collected information with a Common Vulnerabilities and Exposures (CVE) DB. The threat information association analysis unit 220 outputs an attack information scenario mapping result among the vulnerability information associated with each of the collected information.

The threat scenario derivation unit 230 performs analysis information and threat scenario mapping. The threat scenario derivation unit 230 derives a threat scenario based on the correlation analysis information and maps it. The threat scenario derivation unit 230 derives a threat scenario according to a score and correlation analysis information among a plurality of scenarios.

3A to 3F are diagrams illustrating a method of collecting corporate IT infrastructure information according to the present embodiment.

The threat information diagnosis unit 130 collects enterprise (company S) IT infrastructure information, as shown in FIG. 3A .

The threat information diagnosis unit 130 collects sub domain and IP range information. The threat information diagnosis unit 130 can check the IP band of the corresponding subdomain. The threat information diagnosis unit 130 converts the corresponding IP range into GPS coordinates based on the corresponding IP range, and displays and outputs the displayed location on the map. The threat information diagnosis unit 130 can check whether the DNS (Domain Name System) exists in Korea or abroad. The threat information diagnosis unit 130 displays the service infrastructure location on the map and outputs the sub-domain.

As shown in FIG. 3B , the threat information diagnosis unit 130 collects and analyzes the company (company L) IT infrastructure information and outputs the analysis result.

The threat information diagnosis unit 130 checks mapping information such as an open port, server information, language used, and whether a security solution is used based on the sub-domain. The threat information diagnosis unit 130 may manage CMS Editplus and WordPress plug-in information by mapping it with exposed vulnerability information. The threat information diagnosis unit 130 maps and outputs various information such as sub-domains and ports, and other important server version information.

As shown in FIG. 3C , the threat information diagnosis unit 130 outputs an exposure result of an important public file of a company (company A).

The threat information diagnosis unit 130 may check exposure information of important files to determine whether there is company information (asset) that may be accidentally exposed by accident, not a file shared with the public. As a result of OSINT analysis of the company, the threat information diagnosis unit 130 confirms that files that have not been opened are exposed in addition to some public open information.

As shown in FIG. 3D , the threat information diagnosis unit 130 outputs the result of extracting exposure information of the dark web of the company (company B).

The threat information diagnosis unit 130 provides search result information and URL information in the dark web that can threaten the enterprise. The threat information diagnosis unit 130 enables early detection of information that directly or indirectly threatens threats by using exposed information in the dark web. The threat information diagnosis unit 130 uses OSINT (Open Source INTelligence) to confirm that blockchain-related company information is currently exposed through the dark web.

As shown in FIG. 3E , the threat information diagnosis unit 130 outputs a result of analyzing the exposure of important information of companies (domestic large enterprises, medium-sized enterprises, and small and medium-sized enterprises).

The threat information diagnosis unit 130 uses information retrieved from a search engine or a search site (eg, Google information) to check vulnerability exposure using a SQL injection attack on 'Company A'. In other words, the threat information diagnosis unit 130 checks pre-generated threat information that is helpful in catching a diagnosis target and a point when diagnosing using an external network.

The threat information diagnosis unit 130 additionally confirms the vulnerability exposure through the SQL injection attack of the domestic 'co.kr' domain account among the exposed contents. The threat information diagnosis unit 130 uses the OSINT analysis information to confirm that a customer currently providing a service has been exposed to a SQLi attack in the past.

The threat information diagnosis unit 130 outputs the results of the company (company T) hacking (administrator page, important document/source file exposure, error page exposure, etc.) as shown in FIG. 3f .

A company may periodically review the crawled results of a search engine or search site (eg, Google) to confirm the exposure of threat information. However, there may be some false positives due to the action of exposure information being completed among the crawled result pages or by searching for similar results. The threat information diagnosis unit 130 provides a plurality of directly exposed threat information (error page, administrator page, DB error page, Pastebin, etc.) using hacking information.

4 is a diagram illustrating a method of collecting corporate employee information according to the present embodiment.

As shown in FIG. 4 , the threat information diagnosis unit 130 outputs the result of extracting employee exposure information for the company (company C). The threat information diagnosis unit 130 finds and maps company mail/name/phone number, which is personal information exposed to an external social network, or the like.

The threat information diagnosis unit 130 additionally extracts personal company email information exposed to Pastebin, etc. by using a hacking result of a search engine or a search site (eg, Google). The threat information diagnosis unit 130 collects company email information published in a community (Pastebin, etc.) through a search engine or a search site (eg, Google) hacking in addition to the public social information.

5A and 5B are diagrams illustrating a data association analysis method according to the present embodiment.

As shown in FIG. 5A , the threat information diagnosis unit 130 associates and analyzes data of company D as a data correlation analysis to map vulnerability information.

The threat information diagnosis unit 130 provides correlation analysis vulnerability mapping information based on the collected corporate infrastructure information and vulnerability information. The threat information diagnosis unit 130 maps the related analysis information to a global Common Vulnerabilities and Exposures (CVE) DB and provides additional information using a link.

As shown in FIG. 5B , the threat information diagnosis unit 130 analyzes whether the virtual currency ICO R company is exposed to potential vulnerabilities as a data correlation analysis. The threat information diagnosis unit 130 provides Wordpress version and plug-in-related vulnerability information through data correlation analysis. The threat information diagnosis unit 130 outputs the attack information scenario mapping result using the association analysis.

6 is a diagram illustrating detailed management of a management target and a subject according to the present embodiment.

As shown in FIG. 6 , the vulnerability management unit 140 manages the inspection target asset (system, operation/development URL, etc.) status and management subject. The vulnerability management unit 140 manages information according to a service check plan, scheduled completion date, and the like.

In general, prior to the introduction of security diagnosis, it is difficult to identify the target of vulnerability management (business site, assets, etc.) The vulnerability management unit 140 Identify assets to be diagnosed and clarify the subject of service management by business site, minimize the risk of vulnerability exposure, determine whether or not they are not used, and determine their importance.

The vulnerability management unit 140 manages diagnosis target information and manages an inspection plan.

7A and 7B are diagrams illustrating vulnerability check and action status management according to the present embodiment.

As shown in FIG. 7A , the vulnerability management unit 140 manages the status of the entire management target, the vulnerability diagnosis order, the diagnosis date, and the like. The vulnerability management unit 140 manages the presence or absence of measures and whether additional implementation checks have been completed.

In general, before the introduction of security diagnosis, the management of the target for vulnerability diagnosis based on the detailed URL of the service to be diagnosed is insufficient, the management of the action plan of the action implementer is omitted, and the execution check of the diagnostic performer is insufficient. The vulnerability management unit 140 is capable of identifying vulnerabilities, diagnoses, and actions for multiple diagnostic target URLs of one service. The vulnerability management unit 140 can determine the implementation rate according to the action plan. The vulnerability management unit 140 is capable of managing whether or not to check for each target.

The vulnerability management unit 140 automatically aggregates predefined manual diagnosis result file upload and vulnerabilities.

As shown in FIG. 7B , the vulnerability management unit 140 manages each diagnostic item criterion, whether a vulnerability is found, a degree of risk, and a residual case. The vulnerability management unit 140 manages a history of implementation measures for each service operation person in charge.

In general, implementation actions were delayed due to vulnerabilities identified before the introduction of security diagnosis and lack of service operators, and omissions/insufficiency of measures occurred due to insufficient management of detailed measures for each vulnerability in the diagnosis target. The vulnerability management unit 140 enables easy implementation management by managing the mapping between the identified vulnerabilities and the service operator. The vulnerability management unit 140 prevents omissions and inadequacies in implementation measures by identifying whether implementation is managed for each detailed vulnerability.

The vulnerability management unit 140 checks the status of the vulnerability diagnosis item standard implementation check.

8 is a view showing vulnerability check schedule management according to the present embodiment.

As shown in FIG. 8 , the vulnerability management unit 140 manages the schedule of each diagnosis target and the diagnoser in real time. The vulnerability management unit 140 manages an accurate diagnosis man-hour and schedule for each diagnosis.

In general, prior to the introduction of security diagnosis, it is difficult to grasp the schedule for each diagnosis target, and when the schedule is changed, it is difficult to adjust the entire schedule, and it is difficult to grasp the schedule/appropriate manpower for the diagnosis. The vulnerability management unit 140 can grasp the entire schedule plan in real time. The vulnerability management unit 140 can immediately adjust the security diagnosis of new and changed services. The vulnerability management unit 140 makes it easy to identify the diagnosis schedule/management.

The vulnerability management unit 140 may output a diagnostic target standard schedule status and a diagnostician standard schedule status.

9 is a diagram illustrating automation of diagnosis start and end reporting according to the present embodiment.

As shown in FIG. 9 , the vulnerability management unit 140 performs automatic mailing to a corresponding service person at the start of the inspection. The vulnerability management unit 140 automatically generates a vulnerability summary report and provides an automatic result report upon completion of the inspection.

In general, it takes a lot of man-hours due to repetitive manual tasks for multiple users before the introduction of security diagnosis. For example, manual mailing for each team/person in charge and mailing of results for each team/person in charge requires a lot of man-hours. The vulnerability management unit 140 minimizes management man-hours by using repetitive task automation. The vulnerability management unit 140 supports automatic mailing and automatic generation of result reports.

The vulnerability management unit 140 generates an automatically generated diagnosis result summary report.

10 is a diagram illustrating automatic diagnosis of new vulnerabilities according to the present embodiment.

As shown in FIG. 10 , the vulnerability management unit 140 provides automatic inspection of new vulnerabilities (CVEs) and history management. The vulnerability management unit 140 manages the overall business site assets and the new vulnerability mapping standard security impact.

In general, prior to the introduction of security diagnosis, automatic diagnosis cannot be identified due to insufficient management of diagnosis target services and asset information. The vulnerability management unit 140 is capable of continuously managing a list of added/changed assets and identifying an automatic diagnosis target. The vulnerability management unit 140 can perform automatic/repeated diagnosis within minutes. The vulnerability management unit 140 can immediately determine the impact of a new vulnerability.

The vulnerability management unit 140 adds an automatic diagnosis function and performs automatic diagnosis for a newly released vulnerability.

11 is a diagram illustrating automatic trace generation of a diagnosis result according to the present embodiment.

As shown in FIG. 11 , the vulnerability management unit 140 provides a summary of the check result and vulnerability. The vulnerability management unit 140 automatically attaches a screenshot of the vulnerability diagnosis result.

In general, it takes a lot of time to update and manage manual inspection results before introducing security diagnosis, and it is difficult to manage inspection result evidence. The vulnerability management unit 140 reduces time and human errors due to the automated inspection result update, and enables automated vulnerability document management.

The vulnerability management unit 140 is capable of automatically taking screenshots of the vulnerable screen and storing attachments.

The above description is merely illustrative of the technical idea of this embodiment, and various modifications and variations will be possible by those skilled in the art to which this embodiment belongs without departing from the essential characteristics of the present embodiment. Accordingly, the present embodiments are intended to explain rather than limit the technical spirit of the present embodiment, and the scope of the technical spirit of the present embodiment is not limited by these embodiments. The protection scope of this embodiment should be interpreted by the following claims, and all technical ideas within the equivalent range should be interpreted as being included in the scope of the present embodiment.

100: integrated security diagnostic device
110: first diagnosis unit 120: second diagnosis unit
130: threat information diagnosis unit
140: vulnerability management unit
210: threat information collection unit
220: threat information correlation analysis unit
230: threat scenario derivation unit

Claims (6)

a first diagnostic unit generating first diagnostic information for diagnosing a diagnostic item set as a default for a plurality of diagnostic targets at a preset diagnostic cycle;
a second diagnosis unit generating second diagnosis information obtained by diagnosing additional diagnosis items with respect to the plurality of diagnosis targets at a different diagnosis cycle than that of the first diagnosis unit;
a threat information diagnosis unit generating scanning diagnosis information by scanning the plurality of diagnosis target plug-ins; and
A vulnerability analysis result information is generated by analyzing the first diagnosis information, the second diagnosis information, and the scanning diagnosis information, and an automatic report comparing the security levels of the plurality of diagnosis targets with each other based on the vulnerability analysis result information Vulnerability management unit that reports at preset intervals
Including, wherein the vulnerability management unit is based on the second diagnostic information, when the same vulnerability is continuously detected more than a preset number of times or when a critical vulnerability is detected, the detection of a security risk for the same vulnerability or the critical vulnerability In order to set the frequency to be high, the same vulnerability or the fatal vulnerability is added to the diagnostic items set by the default of the first diagnosis unit to diagnose the same vulnerability or the fatal vulnerability at a preset diagnosis cycle in the first diagnosis unit,
IT infrastructure information is collected from the first diagnostic information, the second diagnostic information, and the scanning diagnostic information, and sub-domain and IP range information included in the IT infrastructure information is extracted, and the IP The range is converted into GPS coordinates, the subdomain is displayed on the map at the corresponding coordinates, and the vulnerability analysis result information is output for each subdomain,
Based on the sub-domain included in the IT infrastructure information, a port, server information, language used, and whether or not a security solution is used are mapped and output together with the vulnerability analysis result information, and plug-in information extracted from the scanning diagnosis information is mapped and outputted with the vulnerability analysis result information,
Collecting the disclosed files from the first diagnostic information, the second diagnostic information, and the scanning diagnostic information, and checking the exposure information of the disclosed files, Creates the vulnerability analysis result information by setting the risk of the file high,
Collecting information exposed in the dark web from the second diagnostic information, setting a high degree of risk to the information exposed in the dark web, and generating the vulnerability analysis result information,
From the second diagnostic information, information retrieved using a preset search engine is collected, and a Structured Query Language Injection Attack is performed based on URL and domain accounts among the information retrieved using a preset search engine. After discovering the used vulnerability, the vulnerability analysis result information is generated,
Collecting crawled data from the second diagnostic information, reviewing whether the crawled data is hacked, and setting the risk of hacking confirmed data high to generate the vulnerability analysis result information integrated security diagnostics device. According to claim 1,
The first diagnostic unit
A host, network, system, and application are selected as the plurality of diagnosis targets, and the host, the network, the system, and the application are periodically provided using an anomaly diagnosis tool, an intrusion diagnosis tool, and a vulnerability diagnosis tool. An integrated security diagnosis device, characterized in that generating the first diagnosis information on which abnormal symptom diagnosis, infringement accident diagnosis, and vulnerability diagnosis are performed. 3. The method of claim 2,
Integrated security diagnosis, characterized in that the diagnosis cycle of the first diagnosis unit is set shorter than a preset threshold cycle to have a high diagnosis frequency, and the diagnosis cycle of the second diagnosis unit is set longer than the preset threshold cycle to have a low diagnosis frequency. Device. 4. The method of claim 3,
and the second diagnosis unit generates the second diagnosis information by performing diagnosis on the plurality of diagnosis objects using additional diagnosis tools different from those of the first diagnosis unit. 5. The method of claim 4,
The threat information diagnosis unit,
The integrated security diagnosis apparatus according to claim 1, wherein the scanning information is generated by tracking the degree of risk of the plug-ins of the plurality of diagnosis targets. 6. The method of claim 5,
The vulnerability management unit,
The integrated security diagnosis apparatus of claim 1, wherein the first diagnosis information, the second diagnosis information, and the scanning diagnosis information for the plurality of diagnosis targets are compared with each other and a security risk for each diagnosis item is also output.

Images