KR20240003570A - Cloud security diagnosis service providing system and method - Google Patents

Abstract

The cloud security diagnosis service provision system and method enables the security status of the inspection target to be diagnosed through service-type software, allowing users to quickly identify the security status and vulnerabilities of the system they manage. In addition, when vulnerabilities in the inspection target are detected, the system security of the inspection target can be improved by responding quickly. In addition, in the embodiment, a role for each user and permissions corresponding to the role are created to perform identity and access management for each user, thereby solving the problem of information exposure that may be caused by personnel other than the relevant person during the system security check process. . Additionally, in the embodiment, information received from the cloud security diagnosis system is compared with the CVE to return information on resources with vulnerabilities and store the information to enable continuous vulnerability management.

Description

Cloud security diagnosis service provision system and method {CLOUD SECURITY DIAGNOSIS SERVICE PROVIDING SYSTEM AND METHOD}

This disclosure relates to a system and method for providing a cloud security diagnosis service, and specifically, detects security vulnerabilities in accordance with domestic and foreign compliance regulatory standards through security system updates, determines the security status of the inspection target, and transmits it to the cloud server. It relates to systems and methods.

Unless otherwise indicated herein, the material described in this section is not prior art to the claims of this application, and is not admitted to be prior art by inclusion in this section.

'Cloud computing', one of the most rapidly developing technologies in the current IT field, integrates and provides computing resources that exist in different physical locations in an intangible form, such as a cloud, through virtualization technology. Simply put, it refers to a computing environment in which IT-related services such as data storage, network, and content use can be used all at once through a server on the Internet rather than the electronic device itself. Because the data is not stored on the device itself, it is not affected if the device is lost or accessed from another device.

SaaS (Software as a Service) refers to software as a service and is the highest layer in an organization's cloud strategy. Same as cloud infrastructure services (IaaS, Infrastructure-as-a-service) and platform-as-a-service (PaaS, Platform-as-a-service), the provider provides all physical and virtual core infrastructure, middleware, database management system, and development tools. Provides and hosts, etc. In addition, it is a complete software solution provided to the client organization's end users as a service that provides data and applications, accessed through a specific app or web portal. For example, iCloud, Google Drive, and Naver's MYBOX, which many people use to store and manage content such as photos and videos, are representative models of software as a service (SaaS). . On the corporate side, service-type software also includes corporate messenger, email, video conferencing, and schedule management services. In addition, OTT (Over-the-Top) services such as Netflix, which are gaining sensational popularity around the world these days, are also examples of SaaS. Rather than owning content, SaaS is a 'subscription' method that allows you to use as much content on the Internet as you want through cloud infrastructure. SaaS is packaged software connected to users and displayed equally to all users. You have no control over when updates or upgrades occur, and although some customization features are provided, the entire stack is managed by a third party. Installation and support are typically handled by the vendor, providing the advantage of making the software easier to use. Software-as-a-service is rapidly emerging in various fields, and demand for SaaS that provides security services is also increasing significantly.

1. Korean Patent Registration No. 10-2343501 (2021.12.22) 2. Korean Patent Registration No. 10-2260822 (2021.05.31)

The cloud security diagnosis service provision system and method according to the embodiment analyzes the list of diagnosis items through security system updates, detects security vulnerabilities in accordance with domestic and foreign compliance regulatory standards, and determines the security status of the inspection target.

In the embodiment, after detection of a security vulnerability in the subject to be inspected, the necessary action (write) for the vulnerability is created and delivered through the Common Vulnerabilities and Exposures (CVE) system.

Additionally, in the embodiment, identity and access management (IAM) can be performed by creating a role according to the user who receives the security diagnosis service and granting permissions to the created role.

In addition, in the embodiment, the front server that received the diagnosis request transmits user information for diagnosis to the backend server, and when the backend server receives the information, it determines the type of cloud diagnosis and provides the user key. You can decrypt and perform security diagnosis.

In the embodiment, an API request is sent to the cloud designated by the user, all resource information of the diagnosis target account is received, and resource information is compared with rules provided by the cloud security system according to the embodiment to determine whether it is good or vulnerable and diagnose. Generates a results file containing a list of items and compliance.

The method of providing a cloud security diagnosis service according to an embodiment is (A) the user terminal registers as a member and registers a key, is issued an account accessible to the homepage of a security server that provides a security status diagnosis solution, and logs in to the solution. step; (B) the user terminal prepares for diagnosis by transmitting a diagnosis request for an account for which diagnosis is desired to a security server; (C) The security server sends an API (Application Programming Interface) request to the cloud designated by the user terminal among the multi-clouds, collects all resource information of the account to be diagnosed, and then uses the collected resource information to be provided by the security status diagnosis solution. Diagnosing the security status by comparing it with rules; (D) after the security server completes the diagnosis, storing the security status diagnosis result information so that the diagnosis result can be shared with the user terminal; Includes.

A cloud security diagnosis service providing system according to another embodiment is after registering as a member and registering a key, an account that can access the homepage of a security server that provides a security status diagnosis solution is issued, and the user logs in to the solution and accounts for the desired diagnosis. A user terminal that prepares for diagnosis by transmitting a diagnosis request to a security server; Among multi-clouds, an API request is sent to the cloud designated by the user terminal, and all resource information of the diagnosis target account is collected. Then, the security status is diagnosed by comparing the collected resource information with the rules provided by the security status diagnosis solution. secure server; Includes.

The cloud security diagnosis service provision system and method as described above allows the security status of the inspection target to be diagnosed using service-type software, allowing users to quickly identify the security status and vulnerabilities of the system they manage. In addition, when vulnerabilities in the inspection target are detected, the system security of the inspection target can be improved by responding quickly.

In addition, in the embodiment, a role for each user and permissions corresponding to the role are created to perform identity and access management for each user, thereby solving the problem of information exposure that may be caused by personnel other than the relevant person during the system security check process. .

Additionally, in the embodiment, information received from the cloud security diagnosis system is compared with the CVE to return information on resources with vulnerabilities and store the information to enable continuous vulnerability management.

The effects of the present invention are not limited to the effects described above, and should be understood to include all effects that can be inferred from the configuration of the invention described in the detailed description or claims of the present invention.

1 is a diagram showing a cloud security diagnosis service provision system according to an embodiment
Figure 2 is a diagram showing the signal flow of a cloud security diagnosis service providing system according to an embodiment
Figure 3 is a diagram showing the security diagnosis process of the cloud security diagnosis service provision system according to an embodiment
Figure 4 is a diagram showing the data processing flow for user membership registration and key registration according to an embodiment
Figure 5 is a diagram showing the security diagnosis preparation process of the cloud security diagnosis system according to an embodiment
Figure 6 is a diagram showing the security diagnosis performance process of the cloud security diagnosis system according to an embodiment
Figure 7 is a diagram showing the security diagnosis information transmission process of the cloud security diagnosis system according to an embodiment.
Figure 8 is a diagram showing the configuration of a security server according to an embodiment
Figure 9 is a diagram showing the data processing configuration of the front server 110 according to an embodiment.
Figure 10 is a diagram showing the data processing configuration of the back-end server 130 according to an embodiment.
Figure 11 is a diagram showing a list of diagnosis items and compliance of a cloud security diagnosis system according to an embodiment

The advantages and features of the present invention and methods for achieving them will become clear by referring to the embodiments described in detail below along with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. The present embodiments are merely provided to ensure that the disclosure of the present invention is complete and to provide common knowledge in the technical field to which the present invention pertains. It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

In describing embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. The terms described below are terms defined in consideration of functions in embodiments of the present invention, and may vary depending on the intention or custom of the user or operator. Therefore, the definition should be made based on the contents throughout this specification.

Figure 1 is a diagram showing a cloud security diagnosis service providing system according to an embodiment.

Referring to FIG. 1, the cloud security diagnosis service provision system according to the embodiment detects security vulnerabilities according to domestic/international compliance regulatory standards of the diagnosis target account through security diagnosis system updates, determines the security status, and sends it to the security server. Forward to (100). The security server 100 according to the embodiment distributes software as a service (SaaS, Software as a Service) for security diagnosis of the diagnosis target account in a distributed manner and installs the service-type software for security diagnosis on the server used by the user. Allows you to perform a security diagnosis on the account being diagnosed. In the embodiment, after user registration and key registration on the user terminal, an account accessible to the homepage of a security server that provides a security status diagnosis solution is issued, and the user logs in to the security diagnosis solution provided by the security server and performs the diagnosis. Prepare for diagnosis by sending a diagnosis request for the desired account to the security server 100.

In the embodiment, in order to register a security diagnosis target, an API (application programming interface) that provides a connection between a computer and a solution is provided through a console method or a programming method. Since the solution provided in the embodiment uses a programming method, a key for an account with access rights is required in the embodiment. Accordingly, in the embodiment, the user account key is received, registered in the solution, and the inspection can be performed by calling the API using the key.

In an embodiment, the security server 100 sends an API (Application Programming Interface) request to a cloud designated by the user terminal among multi-clouds, collects all resource information of the diagnosis target account, and then uses the collected resource information in the security status diagnosis solution. Diagnose the security status by comparing it with the provided rules.

In an embodiment, after detecting a security vulnerability in the diagnosis target, the necessary action (write) for the vulnerability can be created through the Common Vulnerabilities and Exposures (CVE) system and delivered to the user terminal, cloud server, and security server. Additionally, in the embodiment, identity and access management (IAM) can be performed by creating a role according to the user who receives the security service and granting permissions to the created role.

In addition, the cloud security diagnosis service providing system according to the embodiment is to perform security diagnosis of categories including account management, network, logging, monitoring, virtual database, and virtual server. , set security diagnosis items for each category, including virtual servers, and create a guide containing detailed confirmation items to identify vulnerabilities in each security diagnosis item. In the embodiment, security diagnosis of each item can be performed through the generated guide, and security diagnosis results and recommendations according to the guide can be provided to the user.

In addition, in the embodiment, the front server that received the diagnosis request transmits user information for diagnosis to the backend server, and when the backend server receives the information, it determines the type of cloud diagnosis and provides the user key. You can decrypt and perform security diagnosis. In the embodiment, an API request is sent to the cloud designated by the user, all resource information of the diagnosis target account is received, the resource information is compared with the rules provided by the cloud security system according to the embodiment to determine whether it is good or vulnerable, and the result is Create a file.

Figure 2 is a diagram showing the signal flow of a cloud security diagnosis service providing system according to an embodiment.

Referring to Figure 2, in step S10, Common Vulnerabilities and Exposures (CVE) information is collected from the security server and stored in the database. The Common Vulnerabilities and Exposures (CVE) system provides a reference method for publicly known information security vulnerabilities and exposures.

In step S20, the user installs an agent on the server used by the account, and in step S30, information necessary for security diagnosis, such as hardware and software type and version installed in the account used as a security server, is transmitted. In embodiments, an agent is a system that attempts to achieve a goal in a complex dynamic environment and may interact using the external environment, sensors, and actors. In embodiments, the agent may be located in a virtual space environment and include a software agent or intelligent agent that automates repetitive tasks for the purpose of assisting a user with a particular application. In embodiments, an agent may periodically gather information or perform some other service without user intervention.

In step S40, the security server detects information about resources with vulnerabilities by comparing the information received from the user with the CVE. Afterwards, at step S50, the detection information is returned to the user and the detection information is stored in the database to provide continuous vulnerability management services. In addition, in the embodiment, a virtual image is provided on the user terminal so that the user can directly test the corresponding vulnerability, so that the user can check the security diagnosis results of the diagnosis target, including weak, good, etc., and whether or not to take action. Additionally, in the embodiment, if an agent cannot be installed on the server of the user account, a specification written in infrastructure as code (IaC) is transmitted to the security server. Infrastructure as code (IaC) is the process of managing and provisioning computer data centers through computer-readable definition files rather than physical hardware configuration or interface configuration tools. Provisioning refers to allocating, placing, and distributing system resources according to user needs and preparing the system in advance so that it can be used immediately when needed. In the embodiment, the security diagnosis service is identically reproduced based on specification information written in IaC. and perform a CVE diagnosis. Thereafter, in the embodiment, information about resources where vulnerabilities exist is returned and the information is stored in a database to enable continuous vulnerability management. In addition, in the embodiment, a virtual image is provided so that the user can directly test the vulnerability, so that the user can check the vulnerability and whether action should be taken.

Figure 3 is a diagram showing a security diagnosis process of a cloud security diagnosis service providing system according to an embodiment.

Referring to FIG. 3, in step S100, the user registers the user key issued after performing user membership registration on the user terminal to the security server, then issues an account accessible to the homepage of the security server that provides a security status diagnosis solution and provides a solution. Log in. In the embodiment, in step S100, roles are created that grant different access rights to each user, and if specific rights are required in an identity and access management (IAM) user terminal that has not been granted a user key, the role is granted. Role rights are transferred to the designated user for a certain period of time. Afterwards, the identity and access management (IAM) user terminal uses the transferred role to cause the server installed in the customer account to call the API to perform a security diagnosis of the diagnosis target.

In an embodiment, a role granted to a user does not grant authority directly to the user, but creates a role and grants access rights to the created role. Accordingly, in the embodiment, an Identity and Access Management (IAM) user can borrow and use the permissions of a role for a while when specific permissions are needed. In the embodiment, permission to use the authority of the role is provided through role-based asset registration. When role-based asset registration is performed, only users who have been granted a role to access the role can switch to the role and use the authority for a while. Roles created in the embodiment may include roles for users, roles for services, and roles that can be assigned to a server. In the security diagnosis solution according to the embodiment, in an environment where it is difficult to grant a key to the user or diagnosis target account, the server installed in the user account uses a role to call the API to check the security status of the diagnosis target. make it possible

In step S200, the user terminal transmits a diagnosis request for the account for which diagnosis is desired to the security server, and the security server prepares for diagnosis. In the S300 stage, the security server sends an API request to the cloud designated by the user terminal among the multi-clouds, collects all resource information of the diagnosis target account, and compares the collected resource information with the rules provided by the security status diagnosis solution. to diagnose the security status. In step S400, after completing the diagnosis on the security server, the security status diagnosis result information is stored so that the diagnosis results can be shared with the user terminal.

Figure 4 is a diagram showing the data processing flow for user membership registration and key registration according to an embodiment. Referring to FIG. 4, in step S110, the user is issued an account that can access the security diagnosis solution homepage, which is software as a service (SaaS) provided in the embodiment, and logs in. The user who logs in in step S130 logs in to the homepage of the security diagnosis solution, which is software as a service (SaaS) provided in the embodiment. Register the account key in the solution. In step S150, the registered key is encrypted and stored in the database, and the encrypted key is decrypted and used during security diagnosis.

Figure 5 is a diagram showing a security diagnosis preparation process of a cloud security diagnosis system according to an embodiment. In step S210, the security server receives a diagnosis request for an account for which diagnosis is desired from the user terminal. In step S230, when the front server of the security server that has received the diagnosis request transmits user information for diagnosis to the back-end server, the back-end server collects user information for security diagnosis. In step S250, when the backend server receives user information for security diagnosis, it checks what type of cloud diagnosis is being performed. In the embodiment, both the type of cloud performing security diagnosis and the type of cloud diagnosis can be confirmed. Afterwards, the database user's key is decrypted. In step S270, the decrypted key is registered in the environment variable of the backend server to check whether it is the correct key to the API and its consistency.

Figure 6 is a diagram showing a security diagnosis performance process of a cloud security diagnosis system according to an embodiment. Referring to Figure 6, in step S310, an API request is sent from the back-end server to the cloud designated by the user among the multi clouds and all resource information of the diagnosis target account is received. In step S330, the received resource information is compared with the rules provided by the security diagnosis solution, the comparison result determines whether it is good or vulnerable, and a security diagnosis result file is created. In the embodiment, in order to perform security diagnosis of categories including account management, network, logging, monitoring, virtual database, and virtual server, each category including account management, network, logging, monitoring, virtual database, and virtual server2 Set each security diagnosis item and create a guide to identify vulnerabilities in each security diagnosis item. Afterwards, security diagnosis of each item can be performed through the generated guide, and security diagnosis results and recommendations according to the guide can be provided to the user.

Step S330 according to the embodiment is a step of parsing and analyzing the collected resource information and comparing it with rules provided by the security status diagnosis solution, determining whether the diagnosis target account is good or vulnerable according to the comparison result, and When the security status diagnosis is completed on the backend server, it may be configured to include the step of generating a diagnosis result file including a summary and a result report. In the embodiment, once the diagnosis is completed in the back-end server, secondary result creation logic for a summary report and a result report in Excel or Word file format is performed in step S370.

Figure 7 is a diagram showing the security diagnosis information transmission process of the cloud security diagnosis system according to an embodiment.

Referring to FIG. 7, in step S410, after the diagnosis is completed on the back-end server, key information including the diagnosis results are stored in the database so that the front server can share the diagnosis results with the user, and the diagnosis is terminated. In step S430, the diagnosis status is monitored on the front server, and once the diagnosis is completed, notification of diagnosis completion and major vulnerability information is provided to the user via email, push notification, etc.

Figure 8 is a diagram showing the configuration of a security server according to an embodiment. Referring to FIG. 8, the security server 100 according to the embodiment may be configured to include a front server 110 and a back-end server 130. The front server 110 communicates with the user terminal and the account subject to inspection, transmits data necessary for security diagnosis of the account subject to diagnosis to the back-end server 130, and receives diagnosis result information, etc. from the back-end server to account for the user terminal and the subject account to be inspected. Pass it to The back-end server 130 communicates with the front server, collects resource information necessary for security diagnosis of the diagnosis target, and analyzes the resource information to perform security diagnosis of the account to be inspected.

Figure 9 is a diagram showing the data processing configuration of the front server 110 according to an embodiment. Referring to FIG. 9, the front server 110 according to the embodiment includes a communication module 111, a user management module 113, an access rights transfer module 115, a monitoring module 117, and a diagnostic information notification module 119. It may be configured to include. The term 'module' used in this specification should be interpreted to include software, hardware, or a combination thereof, depending on the context in which the term is used. For example, software may be machine language, firmware, embedded code, and application software. As another example, hardware may be a circuit, processor, computer, integrated circuit, integrated circuit core, sensor, Micro-Electro-Mechanical System (MEMS), passive device, or a combination thereof.

When receiving a diagnosis request from a user terminal, the communication module 111 transmits user information for diagnosis to the back-end server. When the back-end server receives the user information, it determines the type of cloud diagnosis and sends the user's key. Decrypt and register the decrypted key in the environment variable of the backend server to check the consistency of the key in the API. The user management module 113 creates roles that grant different access rights to each user. When an identity and access management (IAM) user terminal that has not been granted a user key requests specific permissions, the access rights transfer module 115 transfers role rights from the user terminal to which the role has been granted for a certain period of time. . In the embodiment, a server installed in the customer account calls an API using a role transferred from an identity and access management (IAM) user terminal to perform a security diagnosis of the diagnosis target.

In an embodiment, a role granted to a user does not grant authority directly to the user, but rather creates a role and grants access rights to the created role. Accordingly, in the embodiment, an Identity and Access Management (IAM) user can borrow and use the permissions of a role for a while when specific permissions are needed. In the embodiment, permission to use the authority of the role is provided through role-based asset registration. When role-based asset registration is performed, only users who have been granted a role to access the role can switch to the role and use the authority for a while. Roles created in the embodiment may include roles for users, roles for services, and roles that can be assigned to a server. In the security diagnosis solution according to the embodiment, in an environment where it is difficult to grant a key to the user or diagnosis target account, the server installed in the user account uses a role to call the API to check the security status of the diagnosis target. make it possible

The monitoring module 117 monitors the diagnosis status of the diagnosis target account, and the diagnosis information notification module 119 provides diagnosis completion and major vulnerability notification information to the user when the security diagnosis of the diagnosis target account is completed.

In an embodiment, an installed security diagnosis service may be provided. The installed cloud security service provided in the embodiment is mostly similar to the Software as a Service (SaaS) type, but the difference is that identity and access management (IAM) roles are used for customers who cannot provide an access key. There is. The installable service according to the embodiment shares the AMI and proceeds with installation. Configuration is completed by installing the corresponding AMI and granting a role with specific permissions to the loaded image. In the embodiment, when the provided image is loaded, a web service with the same configuration as a software-as-a-service (SaaS) service can be accessed, and the diagnosis results are stored in the image to prevent data from being shared externally. The installed security diagnosis service provided in the embodiment does not share data externally, but all other services are provided in the same way as the security diagnosis service provided in the form of software as a service (SaaS).

Figure 10 is a diagram showing the data processing configuration of the back-end server 130 according to an embodiment.

Referring to FIG. 10, the back-end server 130 according to the embodiment may be configured to include a consistency confirmation module 131, an analysis module 133, a judgment module 135, and a result information generation module 137. .

When receiving user information, the consistency check module 131 determines the type of cloud diagnosis, decrypts the user's key, and registers the decrypted key in the environment variable of the backend server to check the consistency of the key in the API. The analysis module 133 parses and analyzes the collected resource information and compares it with rules provided by the security status diagnosis solution. The judgment module 135 determines whether the diagnosis target account is good or weak according to the comparison result. When the security status diagnosis of the diagnosis target account is completed, the result information generation module 137 generates a diagnosis result file including a summary and a result report.

In the embodiment, the analysis module 133 of the back end server 130 is used to perform security diagnosis of categories including account management, network, logging, monitoring, virtual database, and virtual server. , set security diagnosis items for each category, including virtual databases and virtual servers, and create a guide containing detailed check items to identify vulnerabilities in each security diagnosis item. Afterwards, security diagnosis of each item can be performed through the generated guide, and security diagnosis results and recommendations according to the guide can be provided to the user.

Figure 11 is a diagram showing a list of diagnosis items and compliance of a cloud security diagnosis system according to an embodiment. Referring to FIG. 11, the cloud security diagnosis system according to the embodiment performs a security diagnosis on the diagnosis subject for which a security diagnosis has been requested and then provides diagnosis result information including a list of diagnosis items, task classification, item code, item, and compliance in Excel and Word. It can be created and saved as a file and delivered to the user terminal, cloud server, and security server that requested security diagnosis.

Additionally, the security diagnosis system according to the embodiment can perform security diagnosis in categories including account management, network, logging, monitoring, virtual database, and virtual server. In the embodiment, the account management classification diagnostic items include limiting the use of root account credentials, deleting or disabling root account access keys, setting MFA for the root account, setting MFA for IAM users, deleting credentials that have not been used for more than 90 days, 90 Access keys that have been used for more than one day, weak cloud user account password security policies, removal of cloud accounts with important policies other than virtual server service administrator, removal of cloud accounts with important policies other than virtual database service administrator, and granting of important policies other than virtual storage administrator It may include items such as removal of a cloud account and deletion of an inferable account, and in the embodiment, a security diagnosis for each item of the account management classification is performed according to a guide, and the diagnosis results and recommendations are delivered to the user.

In the embodiment, the root account credential use restriction item checks whether the cloud root account has been used for access within 7 days (default) to minimize the use of root credentials according to the guide during security diagnosis, and anyone with root credentials is We recommend locking down the use of the root account as it has unrestricted access to all resources in the cloud. In addition, it may be recommended to delete or deactivate credentials that have not been used for more than 90 days after performing a security diagnosis on the deletion of credentials that have not been used for more than 90 days. Embodiments may reduce the likelihood that a compromised account will be used without the user's knowledge by deleting or disabling the relevant credentials (such as a password or access key).

In an embodiment, network classification includes setting security group rules to allow and restrict all inbound traffic, setting security group rules to determine whether IPs from unknown sources are used, setting NACL rules to allow and restrict all inbound traffic, and not using. It may include items such as disconnecting from a private subnet and assigning unnecessary public IPs. In the embodiment, a security diagnosis for each item of the network classification is performed according to a guide, and the diagnosis results and recommendations are delivered to the user. In the embodiment, the security group rule setting item performs a security diagnosis by checking inbound rules that allow unrestricted access to specific service ports in the virtual server security group according to the guide for each item, and the unnecessary public IP allocation item is used to determine whether external connections are unnecessary. You can perform a security diagnosis by checking whether a public IP is assigned to the virtual server.

In an embodiment, the logging classifications include: enabling cloud logging service in all cloud service locations, enabling cloud logging service validation, restricting virtual storage access, encrypting cloud logging service, enabling virtual storage default encryption for log storage, enabling virtual internal network traffic logs, and cloud auditing. It may include service activation items, and in the embodiment, security diagnosis for each item in the logging classification is performed according to a guide, and diagnosis results and recommendations are delivered to the user.

In the embodiment, the security diagnosis of the cloud audit service activation item is performed by checking whether the cloud audit service function is activated at all cloud service locations according to the security diagnosis guide for each item, and the cloud logging service encryption item is performed through encryption provided by the cloud service. You can perform a security diagnosis by applying to check whether cloud log data is encrypted.

In embodiments, monitoring classifications include enabling log metrics filtering and alerts on unauthorized API calls, enabling log metrics filtering and alerts when logging in to the cloud management console without MFA, enabling log metrics filtering and alerts when using the root account, and changing cloud IAM policies. Enable log metrics filtering and alerts for Cloud Logging Service changes, enable log metrics filtering and alerts for Cloud Management Console authentication failures, enable log metrics filtering and alerts for virtual storage policy changes, Cloud Audit Enable log metrics and alerts on service configuration changes, enable log metrics and alerts on Security Group changes, enable log metrics and alerts on NACL changes, enable log metrics filtering and alerts on cloud external network gateway changes, and enable log metrics and alerts on routing table changes. It may include log metric filtering and alarm activation for cloud virtual internal network changes, log metric filtering and alarm activation for cloud virtual internal network changes, and log metric filtering and alarm activation for cloud customer-managed key deactivation or deletion schedule, and in an embodiment, monitoring. A security diagnosis for each item in the classification is performed according to the guide, and the diagnosis results and recommendations are delivered to the user.

In an embodiment, the security diagnosis of log metric filtering and alarm activation items for cloud customer-managed key deactivation or deletion reservation is performed according to the security diagnosis guide for each item, and the cloud monitoring service alarm detects whenever the cloud customer-managed key configuration is changed. This can be done by checking whether it is activated, and log metric filtering and alarm activation for changes to the cloud virtual internal network and security diagnosis of alarm activation items can be performed by checking whether the cloud monitoring service alarm, which detects whenever the cloud virtual internal network configuration is changed, is activated. It can be done. In the embodiment, a cloud monitoring service alarm is set to detect changes in the cloud virtual internal network environment configuration, prevent unauthorized network access, and prevent mistakes or malicious modifications that may lead to other security incidents.

The virtual database classification according to the embodiment includes virtual database basic environment configuration settings, Oracle default network encryption (NNE) settings, Oracle SSL settings, Oracle Enterprise Manager (OEM) settings, Oracle UTL MAIL settings, virtual database logging settings, and virtual database encryption settings. Applicability and virtual database public snapshot items may be included, and in the embodiment, a security diagnosis for each item of the virtual database classification is performed according to a guide, and the diagnosis results and recommendations are delivered to the user. Classification of virtual servers according to the embodiment includes whether to use unencrypted cloud virtual volume storage, whether or not important information in the user data area is exposed, whether to use unencrypted cloud virtual volume storage snapshots, and whether or not cloud virtual volume storage public snapshots are exposed. It may include, and in an embodiment, a security diagnosis for each item of the virtual server classification may be performed according to a guide, and the diagnosis results and recommendations may be delivered to the user.

The cloud security diagnosis service provision system and method as described above allows the security status of the inspection target to be diagnosed using service-type software, allowing users to quickly identify the security status and vulnerabilities of the system they manage. In addition, when vulnerabilities in the inspection target are detected, the system security of the inspection target can be improved by responding quickly. In addition, in the embodiment, a role for each user and permissions corresponding to the role are created to perform identity and access management for each user, thereby solving the problem of information exposure that may be caused by personnel other than the relevant person during the system security check process. .

Additionally, in the embodiment, information received from the cloud security diagnosis system is compared with the CVE to return information on resources with vulnerabilities and store the information to enable continuous vulnerability management.

The disclosed content is merely an example, and various modifications and implementations may be made by those skilled in the art without departing from the gist of the claims, so the scope of protection of the disclosed content is limited to the above-mentioned specific scope. It is not limited to the examples.

Claims (10)

In the method of providing cloud security diagnosis service,
(A) the user terminal registers as a member and registers a key, obtains an account accessible to the homepage of a security server that provides a security status diagnosis solution, and logs in to the solution;
(B) the user terminal prepares for diagnosis by transmitting a diagnosis request for an account for which diagnosis is desired to a security server;
(C) The security server sends an API (Application Programming Interface) request to the cloud designated by the user terminal among the multi-clouds, collects all resource information of the account to be diagnosed, and then uses the collected resource information to be provided by the security status diagnosis solution. Diagnosing the security status by comparing it with rules;
(D) after the security server completes the diagnosis, storing the security status diagnosis result information so that the diagnosis result can be shared with the user terminal; A method of providing a cloud security diagnosis service including.
The method of claim 1, wherein step (B); Is
The front server of the security server receiving the diagnosis request from the user terminal transmits user information for diagnosis to the back-end server;
When the back-end server of the security server receives the user information, identifying a cloud that performs security diagnosis and decrypting the user's key; and
registering the decrypted key in an environment variable of a backend server and confirming the consistency of the key in the API; A method of providing a cloud security diagnosis service comprising:
The method of claim 1, wherein step (C); Is
Parsing and analyzing the collected resource information and comparing it with rules provided by the security status diagnosis solution;
A step of determining whether the diagnosis target account is good or weak according to the comparison result; and
When the security status diagnosis is completed in the backend server, generating a diagnosis result file including a summary and a result report; A method of providing a cloud security diagnosis service comprising:
The method of claim 1, wherein step (D); Is
Monitoring the diagnosis status on the front server and providing notification information of diagnosis completion and major vulnerabilities to the user when the security diagnosis of the diagnosis target account is completed; A method of providing a cloud security diagnosis service comprising:
The method of claim 1, wherein step (A); Is
Creating roles that grant different access rights to each user;
When a specific authority is required in an identity and access management (IAM) user terminal that has not been granted a user key, transferring role authority to a user granted the role for a certain period of time; and
Identity and Access Management (IAM) The user terminal performs a security diagnosis of the diagnosis target by calling an API from a server installed in the customer account using the transferred role; A method of providing a cloud security diagnosis service comprising:
In the cloud security diagnosis service provision system,
After registering as a member and registering a key, you are issued an account that can access the homepage of a security server that provides a security status diagnosis solution, log in to the solution, and prepare for diagnosis by sending a diagnosis request for the account you want to diagnose to the security server. a user terminal;
After sending an API request to the cloud designated by the user terminal among multi-clouds and collecting all resource information of the diagnosis target account, the security status is diagnosed by comparing the collected resource information with the rules provided by the security status diagnosis solution. a secure server; Including,
the security server; Is
A front server that communicates with the user terminal and the account subject to inspection; and
a back-end server that communicates with the front server and performs a security diagnosis of the account to be inspected; A cloud security service provision system comprising:
The system of claim 6, further comprising: the front server; Is
When receiving a diagnosis request from a user terminal, user information for diagnosis is transmitted to the back-end server,
The backend server is
Cloud security diagnosis, which is characterized by identifying the type of cloud diagnosis upon receiving user information, decrypting the user's key, and registering the decrypted key in the environment variable of the backend server to check the consistency of the key in the API. Service delivery system.
The system of claim 6, further comprising: the backend server; Is
Analysis module that parses and analyzes collected resource information and compares it with rules provided by the security status diagnosis solution;
A judgment module that determines whether the diagnosis target account is good or weak according to the comparison results; and
When the security status diagnosis is completed, a diagnosis result information generation module that generates a diagnosis result file including a summary and a result report; A cloud security diagnosis service provision system comprising:
The system of claim 6, further comprising: the front server; Is
A monitoring module that monitors the diagnosis status of the account subject to diagnosis; and
A diagnosis information notification module that provides diagnosis completion and major vulnerability notification information to the user upon completion of the security diagnosis of the account subject to diagnosis; A cloud security diagnosis service provision system comprising:
The system of claim 6, comprising: a front server; Is
A user management module that creates roles that grant different access rights to each user; and
When an identity and access management (IAM) user terminal that has not been granted a user key requests specific permissions, an access rights transfer module that transfers role rights from the user terminal to which the role has been granted for a certain period of time; contains
A cloud security diagnosis service providing system, wherein a server installed in a customer account calls an API using the transferred role in the identity and access management (IAM) user terminal to perform a security diagnosis of the diagnosis target.