Vol. 52 No (Mar. 2011) 1, A Case Study of a Security Measure Selection Scheme with Consideration of Potential Lawsuit Masakat

Size: px

Start display at page:

Download "Vol. 52 No (Mar. 2011) 1, A Case Study of a Security Measure Selection Scheme with Consideration of Potential Lawsuit Masakat"

いつやにばし
5 years ago
Views:

1 Vol. 52 No (Mar. 2011) 1, A Case Study of a Security Measure Selection Scheme with Consideration of Potential Lawsuit Masaatsu Nishigai, 1, 2 Yuma Usui, 3 Taumi Yamamoto, 1 Fumihio Magata, 4 Yoshimi Teshigawara 5 and Ryoichi Sasai 6 Incidents on ICT systems will result in lawsuits. Needless to say, information security countermeasures (firewall, data encryption and so on) are essential; if we could protect our system against any security threats including viruses and cracers, incidents such as information leaage due to illegal accesses and/or service suspension due to denial-of-service attac will not occur. However, there could be no perfect countermeasures. Therefore, companies and organizations need to be prepared for litigation. That is, digital forensic countermeasures (management of a variety of system event logs) should be applied with information security countermeasures together. This paper proposes an approach to formulate an optimization problem to select both security and forensics countermeasures that maximizes cost-effectiveness. 1. ICT Information and Communication Technology ISMS Information Security Management System ISMS 1) 3) JNSA ,373 4) 450 Yahoo! BB 5 1 5,500 5) TBC ,000 6) ISMS 1 Graduate School of Science and Technology, Shizuoa University 2 CREST Japan Science and Technology Agency, CREST 3 Graduate School of Informatics, Shizuoa University 4 NTT NTT Information Sharing Platform Laboratories 5 Graduate School of Engineering, Soa University 6 School of Science and Technology for Future Life, Toyo Deni University 1173 c 2011 Information Processing Society of Japan

2 1174 Information Security IS Digital Forensics DF DF IS DF 2 IS DF 3 IS DF IS IS ISMS ALE Annual Loss Expectancy 7) ALE IS IS 8),9) 8) z EBIS ENBIS = EBIS z z 9) 10) 11) 1),2),12) 1) IS 2) Fault Tree IS 12) 2) IS IS 13) 14),15) 16) 2.2 DF DF 17) 18) DF 2 19) 1 DF

3 ) Table 1 Requirements for enhancing legal basis of log. 3. IS DF DF 2 DF DF 2 DF DF DF DF 20) DF DF 4 21) ) DF IS DF IS DF IS IS DF

4 IS IS ISMS EVL EVL EVL = VA PI (1) VA PI 1 I VA PI I IS (2) IS Min(EVL E IS + C IS) (2) EVL (1) E IS C IS IS E IS 0 E IS 1 C IS EVL 3.2 DF DF (1) EVC EVC I VA L VA EVC EVC = VC PO PL (3) VC L PO L PL L (3) DF DF (3) PL 1.0 (3) (4) EVC = VC PO (4) DF DF DF 22) DF DF (5) DF Min(EVC E DF + C DF ) (5) EVC (4) E DF DF C DF

5 1177 DF E DF 0 E DF 1 C DF EVC 3.3 (1) (5) IS DF Min(Loss + Cost) (6) Loss = EVL E IS + EVC E ( DF ( = VA PI )E IS + VC PO )E DF (7) Cost = C IS + C DF (8) IS ICT IS IS E IS IS I EI 0 EI 1 (9) ( VA PI )E IS = VA PI EI (9) (9) PI EI PI IS PI EI DF E DF E DF DF L EL 0 EL 1 (10) ( VC PO )E DF = VC PO EL (10) (10) PO EL L PO 1.0 DF EL L L PO (9) IS PI EI (11) PO = αp I EI (11) α PI EI X αx L (9) (11) (7) (12) Loss = PI EI (VA + αv C EL ) (12) IS DF (6) (8) (12) IS DF Loss (12) Cost (8) Loss + Cost (6) IS DF 4. IS DF A 100 B

6 Table 2 Case study 1. Table 3 3 / Possible factors of information leaage or server down. 2 ISMS 1) 3 10 i i =1, 2,, 10 3 YES 5, USB 1 1 I 1 3 YES 2 I 2 I 1 {1, 2, 3, 4, 5, 6, 7, 8} I 2 {1, 2, 3, 4, 5, 9, 10} I i =1, 2 i =1, 2,, 10 I i P i I i 1 P i I =1 2 Π(1 P i ) I 1 I 2 PI 1 Π(1 P i ) 1 1 2)

7 1179 PI 1 PI PI IS I 1 1 I 2 Yahoo! BB 25),26) Yahoo! BB ),24) X I 1 VA 1 (13) VA 1 = 887X (13) (13) VA 1 A 88,700 B 444 IPA 27) 300 7, ,546 I 2 VA 2 A 7,253 B 1,546 I 1 VC 1 1 6) 1 10,000 (13) 1 31) X VC 1 (14) VC 1 =9500X (14) (14) VC 1 A 950,000 B 4,751 I 1 L 1 PO 1 (11) IS PI 1 IS PI 1EI 1 α JNSA TBC α ) BP % 28) 95% 29) IBM 30) α = )

8 IS Table 4 Relation between incident s factors and IS countermeasures I 1 I 2 IS L 1 DF IS 3 IS 1) 18 IS 4 E IS C IS IS IS I 1 PI PI 1 = DF DF DF NTP Networ Time Protocol WORM write once read many 8 DF ) ) 13 DF E DF DF 13 DF E DF DF PL 8 DF 13 C DF DF 1 13 DF DF

9 1181 Table 5 5 DF Relation between requirements for log and DF countermeasures. 6 1 Table 6 Countermeasure selection in case study WORM NTP WORM NTP 11 WORM NTP DF X 80 X WORM DF EDF PL A B (6) (8) (12) 2 5 IS DF 6 A 102 5,737 IS DF 9 DF IS 6,237 IS 30 IS DF B DF C D 7 IS 1 1

10 Table 7 Case study Table 8 Countermeasure selection in case study VA VA VC VA 3.2 α 0.5 DF C D (6) (8) (12) IS DF 8 C 4.9 3,537 IS DF 1.3 DF IS 3,142 IS 1.8 IS DF D 5. IS DF α α 1.0 α α

11 1183 1) Vol.45, No.8, pp (2004). 2) Vol.41, No.8, pp (2000). 3) SI Vol.62, No.7, pp.7 10 (2007). 4) JNSA ) INTERNET Watch Yahoo!BB 1 5, ) Security Next TBC ) Bojanc, R. and Jerman-Blazic, B.: An economic modeling approach to information security ris management, International Journal of Information Management, Vol.28, Issue 5, pp (2008). 8) Gordon, L.A. and Loeb, M.P.: The Economics of Information Security Investment, ACM Trans. Information and System Security, Vol.5, No.4, pp (2002). 9) 2003 SCIS2003 Vol.1, pp (2003). 10) Tatsumi, K. and Goto, M.: Optimal timing of information security investment: A real options approach, The 8th Worshop on the Economics of Information Security (WEIS 2009 ). (see 11) D1-3 (2009.1). 12) Vol.43, No.8, pp (2002). 13) Vol.46, No.8, pp (2005). 14) 2007 CSS2007 pp ( ). 15) DICOMO2007 pp (2007.7). 16) 2007 CSS2007 pp ( ). 17) Dig-Force DICOMO2008 pp (2008.7). 18) 2009 AS-1-3 (2009.3). 19) pp.2 18, (2006). 20) McKemmish, R.: When is digital evidence forensically sound?, Research advances in digital forensics IV, pp.3 15, Springer (2008). 21) E1-6 (2008.1). 22) 2009 AS-1-1 (2009.3). 23) JNSA ) chart02 a.html 25) CNET JAPAN BB ) MSN ) IPA ) Niei BP 29) 30) IBM 31) IT IT IT p.516, (2004).

12 ) 2 p.14, p.48, p.220, (2003). ( ) ( ) PD NEC DC1 PD 1992 NTT e-learning IEEE ACM IT 2008

Vol.55 No (Jan. 2014) saccess 6 saccess 7 saccess 2. [3] p.33 * B (A) (B) (C) (D) (E) (F) *1 [3], [4] Web PDF a m

Vol.55 No (Jan. 2014) saccess 6 saccess 7 saccess 2. [3] p.33 * B (A) (B) (C) (D) (E) (F) *1 [3], [4] Web PDF a m Vol.55 No.1 2 15 (Jan. 2014) 1,a) 2,3,b) 4,3,c) 3,d) 2013 3 18, 2013 10 9 saccess 1 1 saccess saccess Design and Implementation of an Online Tool for Database Education Hiroyuki Nagataki 1,a) Yoshiaki