Threat analysis system and threat analysis method
A threat analysis system includes a storage unit that stores first information in which a device configuring a threat analysis target system and a vulnerability included in the device are associated with each other, and second information in which the device and a threat from a viewpoint of a business operator assumed in the threat analysis target system are associated with each other; a threat analysis processing unit that associates the vulnerability included in the device and a threat in the threat analysis target system with each other on a basis of the first information and the second information stored in the storage unit; and a threat-analysis result output unit that outputs a relationship between the vulnerability and the threat associated by the threat analysis processing unit.
1. A threat analysis system comprising:
a storage unit that stores first information in which a device configuring a threat analysis target system and a vulnerability included in the device are associated with each other, and second information in which the device and a threat from a viewpoint of a business operator assumed in the threat analysis target system are associated with each other;
a threat analysis processing unit that associates the vulnerability included in the device and a threat in the threat analysis target system with each other on a basis of the first information and the second information stored in the storage unit; and
a threat-analysis result output unit that outputs a relationship between the vulnerability and the threat associated by the threat analysis processing unit.
2. The threat analysis system according to claim 1 ,
wherein in the storage unit, third information is further stored in which a type of the vulnerability included in the device, a type of a control operation related to the device, and a vulnerability influence degree of the vulnerability on the control operation are associated with one another,
the threat analysis processing unit further associates the control operation having the vulnerability influence degree of a predetermined value corresponding to the type of the vulnerability included in the device and the type of the control operation related to the device on the basis of the third information stored in the storage unit, and
the threat-analysis result output unit outputs a relationship among the vulnerability, the threat, and the control operation associated by the threat analysis processing unit.
3. The threat analysis system according to claim 2
wherein in the threat analysis processing unit,
the information of the control operation associated with, and related to the device and the type of the vulnerability included in the device is stored in the storage unit, and
in the association of the control operation, when the information of the control operation associated with the device and the type of the vulnerability included in the device exists in the storage unit, the information of the control operation stored in the storage unit is used.
4. The threat analysis system according to claim 1 , further comprising an influence-degree evaluation processing unit that evaluates a magnitude of an influence of the vulnerability included in the device on the threat in the threat analysis target system, using a predetermined algorithm.
5. The threat analysis system according to claim 4 ,
wherein the influence-degree evaluation processing unit uses a Bayesian network with the vulnerability included in the device, the control operation related to the device, and the threat in the threat analysis target system as nodes to evaluate the magnitude of the influence of the vulnerability included in the device on the threat in the threat analysis target system, and a magnitude of an influence of the vulnerability included in the device on the control operation related to the device, and
the threat-analysis result output unit outputs a result from the evaluation by the influence degree evaluation processing unit.
6. A threat analysis method in a threat analysis system having a storage unit that stores first information in which a device configuring a threat analysis target system and a vulnerability included in the device are associated with each other, and second information in which the device and a threat from a viewpoint of a business operator assumed in the threat analysis target system are associated with each other, the analysis method comprising:
a first step in which a threat analysis processing unit associates the vulnerability included in the device and a threat in the threat analysis target system with each other on a basis of the first information and the second information stored in the storage unit; and
a second step in which a threat-analysis result output unit outputs a relationship between the vulnerability and the threat associated by the threat analysis processing unit.