System design device, system design method, and storage medium
First configuration information is acquired, which includes information on a topology using components of any one component of nodes in a computer system and an edge indicating a relationship between nodes. A configuration of a topology of first configuration information is concretized. Whether or not a security threat event may occur in a node or an edge in the configuration of the concretized topology is determined, and configuration information is generated in which information indicating a relationship between the configuration component in which a threat may occur if the threat event may occur and another configuration component in which another threat contributing to the occurrence of the threat may occur, is added. Whether the content of each threat is concrete or abstract in a threat chain path based on the relationship between the threat in the configuration information and another threat that contributes to the occurrence of the threat, is determined, and whether or not a design is insecure if the content of the threat is concrete or if it is abstract, is determined.
1 . A system design device comprising:
at least one memory configured to store instructions; and
at least one processor configured to execute the instructions to:
acquire first configuration information at least including information on a topology of a computer system using configuration components in the computer system;
generate second configuration information that concretizes a configuration of the topology in the first configuration information;
determine whether or not a security threat event may occur in the configuration component of the concretized topology, and generate third configuration information by adding information indicating a relationship between: an identifier of a threat if a threat event may occur; the configuration component in which the threat may occur; an identifier of another threat contributing to the occurrence of the threat; and another configuration component in which this another threat may occur, to the second configuration information;
determine whether a content of each threat is concrete or abstract in a threat chain path based on a relationship between the threat in the third configuration information and another threat that contributes to the occurrence of the threat, and determine whether or not a design of a computer system in this third configuration information is insecure if a content of the threat is concrete or if it is abstract; and
determine the design of the computer system of the third configuration information as insecure if the content of the threat is all concrete in the threat chain path, or if the content of the threat is abstract in any configuration component of the threat chain path and it is determined that the abstract threat is unavoidably replaced with a concrete threat.
2 . The system design device according to claim 1 , wherein the at least one processor is configured to execute the instructions to:
generate the second configuration information that concretizes one of grouping units of predetermined configuration components in the topology of the computer system of the first configuration information input at the start of processing;
repeat a process of generating new second configuration information that concretizes the one of grouping units of the predetermined configuration components in the topology of the computer system of the first configuration information, where the third configuration information, generated based on the second configuration information, and not determined to be insecure in the design of the computer system, is used as new first configuration information;
repeat a process of generating the third configuration information based on the second configuration information; and
output the third configuration information as a design result if none of the grouping units of the predetermined configuration components in the topology of the computer system of the third configuration information can be further concretized and the design of the computer system of the third configuration information is not determined as insecure.
3 . The system design device according to claim 1 , wherein the at least one processor is configured to execute the instructions to give information indicating whether information on threat to be added to the second configuration information is concrete or abstract based on a threat concretization rule indicating a threat defined according to the topology, to the third configuration information, and
wherein the at least one processor is configured to execute the instructions to determine the design of the computer system of the third configuration information as insecure (1) if the content of the threat is all concrete in the threat chain path based on the information given to the third configuration information, or (2) if the content of the threat is abstract in any configuration component of the threat chain path and it is determined that there is no means of avoiding the abstract threat from being replaced with the concrete threat.
4 . The system design device according to claim 3 , wherein the at least one processor is configured to execute the instructions to:
identify, if the abstract threat is included in the threat chain path, the path as an abstract attack path indicating the threat chain path along which a security attack may occur, based on the threat included in the path; and
identify, if the abstract threat is not included in the threat chain path, the path as a concrete attack path indicating the threat chain path along which a security attack may occur, based on the threat included in the path.
5 . The system design device according to claim 4 , wherein the at least one processor is configured to execute the instructions to, if the content of the threat is such that any configuration component of the abstract attack path is abstract and all configuration components in which the abstract threat may occur cannot be given the characteristic of preventing the threat, determine that there is no means of avoiding the abstract threat from being replaced with the concrete threat; and
determine the design of the computer system of the third configuration information as insecure.
6 . A system design method comprising:
acquiring first configuration information at least including information on a topology of a computer system using configuration components in the computer system;
generating second configuration information that concretizes a configuration of the topology in the first configuration information;
determining whether or not a security threat event may occur in the configuration component of the concretized topology, and generating third configuration information by adding information indicating a relationship between: an identifier of a threat if a threat event may occur; the configuration component in which the threat may occur; an identifier of another threat contributing to the occurrence of the threat; and another configuration component in which this another threat may occur, to the second configuration information;
determining whether a content of each threat is concrete or abstract in a threat chain path based on a relationship between the threat in the third configuration information and another threat that contributes to the occurrence of the threat, and determining whether or not a design of a computer system in this third configuration information is insecure if a content of the threat is concrete or if it is abstract; and
determining the design of the computer system of the third configuration information as insecure if the content of the threat is all concrete in the threat chain path, or if the content of the threat is abstract in any configuration component of the threat chain path and it is determined that the abstract threat is unavoidably replaced with a concrete threat.
7 . A non-transitory storage medium storing a program that causes a computer of a system design device to execute:
acquiring first configuration information at least including information on a topology of a computer system using configuration components in the computer system;
generating second configuration information that concretizes a configuration of the topology in the first configuration information;
determining whether or not a security threat event may occur in the configuration component of the concretized topology, and generates third configuration information by adding information indicating a relationship between: an identifier of a threat if a threat event may occur; the configuration component in which the threat may occur; an identifier of another threat contributing to the occurrence of the threat; and another configuration component in which this another threat may occur, to the second configuration information;
determining whether a content of each threat is concrete or abstract in a threat chain path based on a relationship between the threat in the third configuration information and another threat that contributes to the occurrence of the threat, and determining whether or not a design of a computer system in this third configuration information is insecure if a content of the threat is concrete or if it is abstract; and
determining the design of the computer system of the third configuration information as insecure if the content of the threat is all concrete in the threat chain path, or if the content of the threat is abstract in any configuration component of the threat chain path and it is determined that the abstract threat is unavoidably replaced with a concrete threat.