위험 관리를 위한 MITRE ATT&CK 기반의 정량적 보안 지표
A Quantitative Security Metric Based on MITRE ATT&CK for Risk Management
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
안전한 네트워크를 위해 보안 평가는 필수불가결한 과정으로, 위험을 관리하기 위해서는 적절한 성능지표가 있어야 한다. 가장 널리 사용하고 있는 정량적 지표로는 CVSS가 있다. CVSS는 주관성과 해석의 복잡성, 보안 위험의 관점에서 맥락을 고려하지 못한다는 문제가 있다. 이러한 문제를 보완하기 위해 ISO/IEC 15408 문서의 보안 개념 및 관계도를 바탕으로 공격자, 위협, 대응, 자산의 4가지를 항목화하고 수치화 하는 지표를 제안한다. 네트워크 스캐닝을 통해 발견된 취약점은 약점, 공격패턴의 연결관계에 의해 MITRE ATT&CK의 기술과 매핑시킬 수 있다. 우리는 MITRE ATT&CK 의 Groups, Tactic, Mitigations을 이용하여 일관성을 가지며 직관적인 점수를 산출한다. 이에 따라 보안 평가 관리자가 다양한 관점의 보안지표 중 선택할 수 있는 폭을 넓히고, 사이버 네트워크의 보안을 강화하는데 긍정적인 영향을 기대한다.
Abstract
Security assessment is an indispensable process for a secure network, and appropriate performance indicators must be present to manage risks. The most widely used quantitative indicator is CVSS. CVSS has a problem that it cannot consider context in terms of subjectivity, complexity of interpretation, and security risks. To compensate for these problems, we propose indicators that itemize and quantify four things: attackers, threats, responses, and assets, taking into account the security context of ISO/IEC 15408 documents. Vulnerabilities discovered through network scanning can be mapped to MITREATT&CK's technology by the connection between weaknesses and attack patterns (CAPEC). We use MITRE ATT&CK's Groups, Tactic, and Mitigations to produce consistent and intuitive scores. Accordingly, it is expected that security evaluation managers will have a positive impact on strengthening security such as corporate networks by expanding the range of choices among security indicators from various perspectives.
참고문헌 (16)
- "MITRE ATT &CK" (2023)[URL]
- Ahn, G., "October). Changes of Cyber Hacking Attack Aspect of North Korea Cyber-Attack Groups Applying MITRE ATT&CK", Research Briefs on Information and Communication Technology Evolution, 7, pp.75~88 (2021)
- Pirca, A. M., "An empirical evaluation of the effectiveness of attack graphs and MITRE ATT&CK matrices in aiding cyber attack perception amongst decision-makers", Computers &Security, 130, pp.103254~ (2023)
- Ahmed, M., "MITRE ATT&CK-driven cyber risk assessment", Proceedings of the 17th International Conference on Availability, Reliability and Security, pp.1~10 (2022)
- Kwon, R., "Cyber threat dictionary using mitre att&ck matrix and nist cybersecurity framework mapping", 2020 Resilience Week (RWS), pp.106~112 (2020), IEEE
- Singhal, A., "Techniques for enterprise network security metrics", Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies, pp.1~4 (2009)
- Pendleton, M., "A survey on systems security metrics", ACM Computing Surveys (CSUR), 49(4), pp.1~35 (2016)
- Doynikova, E., "Ontology of metrics for cyber security assessment", Proceedings of the 14th International Conference on Availability, Reliability and Security, pp.1~8 (2019)
- "CVSS" (2023)[URL]
- "National Institute of Standards and Technology" (2023)[URL]
- Spring, J., "Time to Change the CVSS?", IEEE Security &Privacy, 19(2), pp.74~78 (2021)
- "Charles Griffiths" (2023)[URL]
- "CONSERT (CONsort ium of CERT)" (2023)[URL]
- International Organization for Standardization, "Information Technology; Security Techniques;Evaluation Criteria for IT Security:Part 1: Introduction and General Model. International Organization for Standardization", ~ (2005)
- Ou, X., "MulVAL: A logic-based network security analyzer", USENIX security symposium, 8, pp.113~128 (2005)