1. Field of the Invention
The present invention relates to a security policy management system and method for deriving a security policy from setting details of a security device that is a component of an information system.
2. Description of the Related Art
With the development of the information technology, information security is acquiring growing importance. Today's organizations including enterprises and other institutions are required to have a security policy established from security setting details in their network systems, so that the system administrators and security managers can understand the security policy.
One technique for grasping a security policy is disclosed as a status grasping method in Japanese laid-open patent publication No. 2003-203140 (JP, P2003-203140A). The disclosed status grasping method comprises the steps of asking questions of the members of the target organization, grasping a security situation of the information system of the target organization based on the answers to the questions, grasping a security situation of the information system of the target organization based on the results of an investigation performed by an investigation tool, and establishing a security policy by integrating the information obtained from the above two grasping steps. Publication JP, P2003-203140A also discloses an integrating apparatus for use in carrying out the above status grasping method. The integrating apparatus compares the status of the information system according to the answers to the questions and the status of the information system according to the investigation tool. Portions of these two statuses that match each other are referred to as matched portions, and portions of these two statuses that do not match each other are referred to as unmatched portions. The integrating apparatus separates the unmatched portions from the matched portions, takes out the unmatched portions, and displays the unmatched portions. The integrating apparatus then prompts the user as the system administrator to enter the user's selection with respect to the unmatched portions, displays the result selected by the user, and combines the matched portions and the result selected by the user.
Since the method and apparatus disclosed in JP, P2003-203140A uses not only questions for the members of the organization but also the investigation tool, it is not necessary to ask questions about items that can be investigated with the investigation tool. Furthermore, as the unmatched portions are displayed to prompt the user to make a selection, the user can make a suitable selection from the displayed details, allowing a more appropriate security policy to be established.
The conventional method and apparatus depends upon the experiences and knowledge of the security manager, and constructs a security policy based on the answers to the questions that the members of the organization were asked. Consequently, the conventional method and apparatus suffer problems, to be described below, that are caused by the fact that a security policy is constructed by manual intervention.
First, a large expenditure of labor and time is required to construct and grasp a security policy. A security policy needs to be constructed for each individual organization, and the security manager has to create a security policy from scratch based on his or her experiences and knowledge, and to gather the answers to the questions that the members of the organization were asked. Setting information of existing security devices in the information system of the organization is described according to a format inherent in each security device. There is a tacit understanding with respect to each security device that the description of some information is omitted. A security policy derived from such setting information lacks integrity and is difficult to grasp unless the security policy is manually corrected and adjusted. As a result, a large expenditure of labor and time is required to construct and grasp a security policy.
A second problem is that there is a high possibility of errors and omissions occurring in constructing a security policy and grasping a security status. The reasons for such a high possibility of errors and omissions are that the manual intervention in the process of constructing a security policy is likely to cause errors and omissions due to assumptions and illusions that the security manager and the respondents to the questions may have.
According to JP, P2003-203140A, a scanner is disclosed as the investigation tool for investigating the security status of the information system. However, such an investigation tool may possibly collect erroneous information which is different from the setting details that are actually set in a security device to be investigated.
Security policy management systems for deriving a security policy from setting details of a security device that is a component of an information system are to meet the following demands:
When a security policy is constructed, a security policy management should preferably be able to present the details of the security policy in an understandable way to the manager. A security policy management system should preferably be able to compare the security policies of a plurality of systems, and to compare not only the security policies of a plurality of systems, but also security policies with each other, e.g., the security policy of one system and a predetermined reference security policy with each other.
A security policy management system should preferably be able to analyze a plurality of security policies of the same type in an integrated manner. For example, if there are a plurality of packet filtering devices, then a security policy management system should preferably be able to analyze security policies grasped respectively from the packet filtering devices and specify packets that can pass through all the packet filtering devices.
A security policy management system should preferably be able to interlink security policies or the like having settings for different functions and grasp the relation between those security policies. For example, a security policy management system should preferably be able to interlink a security policy having settings for a packet filtering function and the results of an analysis of settings for an intrusion detecting function, and to determine whether there is an unmatch between the settings or not.